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80186/8/XL/EA/EB/EC Emulation and 
Analysis 



The HP 64767 80186/188 Emulator replaces the microprocessor in your embedded 
microprocessor system, also called the target system, so that you can control 
execution and view or modify processor and target system resources. 

The emulator requires an emulation analyzer that captures 48 channels of emulation 
processor bus cycle information synchronously with the processor's clock signal. 
The HP 64706 (48 channel), the HP 64703 (64 channel), the HP 64704 (80 
channel), or the HP 64794 (80 channel, deep memory) Emulation Bus Analyzer 
meets this requirement. 

The HP 64703 Emulation Bus Analyzer also has an an external analyzer that 
captures up to 16 channels of data external to the emulator. 

With the Emulator, You Can ... 

• Plug into 801 86/1 88/XL/EA/EB/EC target systems. 

• Download programs into emulation memory or target system RAM. 

• Display or modify the contents of processor registers and memory resources. 

• Run programs at clock speeds up to 20 MHz (with no wait-states from 
emulation memory), set up software breakpoints, step through programs, and 
reset the emulation processor. 



With the Analyzer, You Can . 



• Trigger the analyzer when a particular bus cycle state is captured. States are 
stored relative to the trigger state. 

• Qualify which states that get stored in the trace. 

• Prestore certain states that occur before each normal store state. 

• Trigger the analyzer after a sequence of up to 8 events have occurred. 

• Capture data on signals of interest in the target system. 

• Cause emulator execution to break when the analyzer finds its trigger condition. 

With the HP 64700 Card Cage, You Can ... 

• Use the RS-422 capability of the serial port and an RS-422 interface card on 
the host computer (for example, the HP 98659 for the HP 9000 or the 

HP 64037 for the PC) to provide upload/download rates of up to 230.4K baud. 

• Easily upgrade HP 64700 firmware by downloading to flash memory. 

With Multiple HP 64700s, You Can ... 

• Start and stop up to 16 emulators at the same time (up to 32 if modifications 
are made). 

• Use the analyzer in one HP 64700 to arm (that is, activate) the analyzers in 
other HP 64700 card cages or to cause emulator execution in other HP 64700 
card cages to break. 

• Use the HP 64700' s BNC connector to trigger an external instrument (for 
example, a logic analyzer or oscilloscope) when the analyzer finds its trigger 
condition, or you can allow an external instrument to arm the analyzer or break 
emulator execution. 
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In This Book 



This book documents the HP 64767 80186/188/XL/EA/EB/EC emulators and the 
HP 64703/4/6 analyzer. It is organized into five parts whose chapters are described 
below. 

Part 1 . Quick Start Guide 

Chapter 1 presents an overview of emulation and analysis and quickly shows 
you how to use the emulator and analyzer. 

Part 2. User's Guide 

Chapter 2 shows you how to plug the emulator into target systems. 
Chapter 3 shows you how to enter Terminal Interface commands and display 
HP 64700 system information. 
Chapter 4 shows how to use the emulator. 

Chapter 5 shows how to use the analyzer in the "easy" configuration. 
Chapter 6 shows how to use the analyzer in the "complex" configuration. 
Chapter 7 shows how to use external state analyzer. 
Chapter 8 shows how to make coordinated measurements. 

Part 3. Reference 

Chapter 9 describes Terminal Interface commands. 

Chapter 10 describes error messages and provides recovery information. 

Chapter 1 1 lists the emulator and external analyzer specifications and 

characteristics. 

Part 4. Concept Guide 

Chapter 12 contains conceptual (and more detailed) information on various 
topics. 

Part 5. Installation Guide 

Chapter 1 3 shows you how to install emulator and analyzer boards into the 
HP 64700 Card Cage and how to connect the HP 64700 to a host computer or 
terminal. 

Chapter 14 shows you how to install or update emulator firmware. Follow these 
instructions if you have ordered the HP 64767 emulator and the HP 64748C 
emulation control card separately. 
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Quick Start Guide 

A one-glance overview of the product and a few task instructions to help you get 
comfortable. 



17 



Parti 




18 



1 



Getting Started 



19 



The 80186/8/XL/EA/EB/EC Emulator — At a Glance 




20 



Chapter 1 : Getting Started 
The 80186/8/XL/EA/EB/EC Emulator — At a Glance 

The tutorial examples presented in this chapter make the following assumptions: 

• The HP 64700 is connected to the same LAN as an HP 9000 Series 300 host 
computer (refer to the "Installation" chapter). 

• Networking software is installed on your HP 9000 Series 300 host computer 
(primarily telnet and ftp software). 

• The emulator demo program (see the description in the "Concepts" chapter) is 
compiled, assembled, and linked and an HP 64000 format absolute file is 
created. 

• A symbols file has been created. 
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Step 1 . Log in to the emulator 



Step 1 . Log in to the emulator 

• Use the telnet command on the host computer to connect to the HP 64700. 

$ telnet hostname 

Where "hostname" is the name of the emulator. Or, you could use the Internet 
Protocol (IP) address (or internat address) in place of the hostname: 

$ telnet 15.35.226.210 

You should see messages similar to: 

Trying . . . 

Connected to 15.35.226.210 
Escape character is '*]'. 

After you connect to the emulator, you should see a prompt similar to: 

R> 
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Step 2. Initialize the emulator 

Make sure you begin this tutorial with the emulator in its default, power-up state by 
initializing the emulator. 

• Initialize the emulator by entering the ink command. 

R>init 

# Limited initialization completed 
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Step 3. Map memory for the demo program 

Because the emulator can use target system memory or emulation memory (or 
both), it is necessary to map ranges of memory so that the emulator knows where to 
direct its accesses. You can map up to 16 memory ranges with 1 Kbyte resolution 
(beginning on 1 Kbyte boundaries and at least 1 Kbytes in length). 

You can characterize memory ranges as emulation RAM, emulation ROM, target 
system RAM, target system ROM, or as guarded memory. 

Suppose the "ecs" demo program occupies ROM locations from 0 through 3FFH 
and 80000H through 845BFH and RAM locations from 10000H through 1955 1H. 
(You can tell this by looking at the linker load map output listing that is generated 
when compiling the demo program.) 

1 Map emulation memory for the demo program by entering the following map 
commands. 

R>map 0 . . 3f f erom 
R>map 10000.. If 3ff eram 
R>map 80000.. 8ffff erom 

2 View the resulting memory map by entering the map command with no parameters. 

R>map 

# remaining number of terms 

# remaining emulation memory 
map 000000 .. 0003ff erom 
map 010000 .. 01f3ff eram 
map 080000 .. 08ffff erom 
map other tram 

The "other" term in the memory map specifies that unmapped memory ranges are 
treated as target system RAM by default. 
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e0800h bytes 

# term 1 

# term 2 

# term 3 



24 



Chapter 1 : Getting Started 
Step 4. Load the demo program absolute file and symbols 



Step 4. Load the demo program absolute file and 
symbols 

The HP AxLS software development tools generate IEEE-695 format or HP format 
absolute files. However, the Terminal Interface's load command only supports the 
following formats: HP absolute, Intel hexadecimal, Extended Tektronix 
hexadecimal, and Motorola S-records. So, when using the HP AxLS tools, be sure 
to generate HP format absolute files. 

You can typically create an ASCII symbol file using information from a linker load 
map output file; however, the ASCII symbol file must be in the proper format. 

Suppose the following "ecs.sym" file exists on the HP 9000 host computer. 

# 

crtl:entry 0819C:0000A 

init_system:_init_system 08150 : 00002 

init_system:_init_val_arr 08150 : 00050 

main:_ascii_old_data 01009:00190 

main:_aver_temp 01009:005A0 

main :_combsort 08000:002BB 

main :_curr_loc 01009:005AA 

main :_current_humid 01009:005A6 

main :_current_temp 01009 :005A4 

main:_do_sort 08000:00587 

main :_f loat_humid 01009:0059c 

main :_f loat_temp 01009:00598 

main :_func_needed 01009:005AC 

main :_gen_ascii_data 08000:00127 

main :_hdwr_encode 01009 :005AE 

main :_humid_dir 01009:005B0 

main :_interrupt_sim 08000:00032 

main:_main 08000:00000 

main :_num_checks 01009:005A8 

main:_old_data 01009:00000 

main:_strcpy8 08000:000D9 

main :_target_humid 01009:0018E 

main :_target_temp 01009:00180 

main :_temp_dir 01009:005B1 

update_sys :_get_targets 0815A: 00080 

update_sys :_read_conditions 0815A: 0013A 

update_sys :_save_points 0815A: 0031B 

update_sys :_set_outputs 0815A: 001BD 

update_sys :_update_system 0815A: 0000C 

update_sys :_write_hdwr 0815A: 00293 

# 
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Chapter 1 : Getting Started 

Step 4. Load the demo program absolute file and symbols 

1 Escape from telnet to the UNIX shell. 



R> <CTRL>] 

telnet> ! <RETURN> 

$ 



2 Change to the directory that contains the "ecs.X" absolute file and the "ecs.sym" 
symbol file. 



$ cd 80186/demo <RETURN> 



3 Connect to the emulator's ftp interface by entering the ftp command on your local 
host computer (use any name and password). 



Note The "ftp" capability of the HP 64700 is unsupported. It is provided at no cost. 

Hewlett-Packard makes no warranty on its quality or fitness for a particular purpose. 

When connecting to the HP 64700' s ftp interface, you can use either the 
HP 64700' s hostname or the Internet Protocol (IP) address (or internet address). 
When you use the HP 64700' s hostname, the ftp software on your computer will 
look up the internet address in the hosts table, or perhaps a name server will return 
the internet address. 

$ ftp 15.35.226.210 

Connected to 15.35.226.210. 

220 User connected to HP64700 

Name ( 15 . 35 . 22 6 . 2 10 : guest ) : <RETURN> 

Password ( 15 . 35 . 22 6 . 2 10 : guest ) : <RETURN> 



4 Set up ftp for binary file transfers. 



ftp> binary 

200 Type set to I 
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5 Download the HP 64000 format absolute file into the emulator. 



ftp> put ecs.X -h 

200 Port ok 

150 

226- 

R> 

226 Transfer completed 

21190 bytes sent in 0.15 seconds (138.48 Kbytes/sec) 



6 Download the symbol file into the emulator. 



ftp> put ecs.sym -S 

200 Port ok 

150 

226- 

R> 

226 Transfer completed 

932 bytes sent in 0.03 seconds (30.89 Kbytes/sec) 



7 Exit out of the ftp interface: 



ftp> quit 
221 Goodbye 



8 Return to the telnet connection. 



$ <CTRL>d 

[Returning to remote] <RETURN> 
R> 
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Step 4. Display the demo program symbols 



1 Display the symbols with the sym command. 



R>sym 

sym crtl:entry=0819c:0000a 

sym init_system:_init_system=08150 : 00002 

sym init_system:_init_val_arr=08150 : 00050 

sym main :_ascii_old_data=0100 9: 00190 

sym main :_aver_temp=01009 : 005a0 

sym main :_combsort=08000 : 002bb 

sym main :_curr_loc=0 100 9 : 005aa 

sym main :_current_humid=01009 : 005a6 

sym main :_current_temp=0100 9 : 005a4 

sym main:_do_sort=08000:00587 

sym main :_float_humid=0 100 9 : 005 9c 

sym main :_f loat_temp=01009 : 00598 

sym main :_func_needed=0100 9 : 005ac 

sym main :_gen_ascii_data=08000 : 00127 

sym main :_hdwr_encode=01009 : 005ae 

sym main :_humid_dir=01009 : 005b0 

sym main :_interrupt_sim=08000 : 00032 

sym main :_main=08000 : 00000 

sym main :_num_checks=01009 : 005a8 

sym main :_old_data=01009 : 0000c 

sym main :_strcpy8=08000 : 000d9 

sym main :_target_humid=01009 : 0018e 

sym main :_target_temp=01009 : 0018c 

sym main :_temp_dir=01009 : 005bl 

sym update_sys :_get_targets=0815a : 0008c 

sym update_sys :_read_conditions=0 815a :0013a 

sym update_sys :_save_points=0815a : 0031b 

sym update_sys :_set_outputs=0815a : OOlbd 

sym update_sys :_update_system=0815a : 0000c 

sym update_sys :_write_hdwr=0815a : 00293 
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Step 5. Display the demo program in memory 

The m command lets you display and modify memory locations. When displaying 
memory, the -dm option causes the contents of memory locations to be 
disassembled and displayed in assembly language mnemonic format. 



• Display the demo program in memory by entering the following m -dm command. 



R>m -dm main:_main. .main:_main+3f 



0! 


5000 : 


: 00000 


main: _ma i n 


PUSH BP 


0! 


5000 : 


: 00001 




MOV BP, SP 


0! 


5000: 


:00003 




PUSH DS 


0! 


5000: 


:00004 




MOV AX, #1009H 


0! 


5000: 


:00007 




MOV DS,AX | CALL FAR PTR init_system 


0! 


5000: 


: OOOOe 




NOP 


0! 


5000: 


: OOOOf 




CALL FAR PTR update_sys :_update_s 


0! 


5000 : 


: 00014 




INC WORD PTR 05a8H 


0! 


5000 : 


: 00018 




MOV DX, #1009H 


0! 


5000 : 


: 0001b 




NOP 


0! 


5000 : 


: 0001c 




MOV AX, #05a8H 


0! 


5000: 


:0001f 




NOP 


0! 


5000: 


:00020 




PUSH DX 


0! 


5000: 


: 00021 




PUSH AX 


0! 


5000: 


: 00022 




CALL FAR PTR main :_interrupt_sim 


0! 


5000: 


: 00027 




ADD SP,#0004H 


0! 


5000 : 


: 0002a 




NOP 


0! 


5000 : 


: 0002b 




JMP SHORT OOOfH 


0! 


5000 : 


: 0002d 




NOP 


0! 


5000 : 


: 0002e 




NOP 


0! 


5000: 


:0002f 




POP DS I POP BP 


0! 


5000: 


:00031 




RET 


0! 


5000: 


: 00032 


:_interrupt_sim 


PUSH BP 


0! 


5000: 


: 00033 




MOV BP, SP 


0! 


5000: 


: 00035 




SUB SP,#0004H 


0! 


5000: 


:00038 




PUSH DS 


0! 


5000: 


:00039 




MOV AX, #1009H 


0! 


5000 : 


: 0003c 




MOV DS,AX | PUSH SI 


0! 


5000 : 


: 0003f 




LES DI, DWORD PTR 06H[BP] 
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Step 6. Execute the demo program 

The r <addr> command causes the emulator to ran from a particular address. The 
entry address of the demo program is at the symbol "crtlientry". 

• Execute the demo program by entering the r <addr> command. 

R>r crtlientry 

U> 

Before the r command, the emulation status character (in the Terminal Interface 
prompt) was "R" indicating that the emulation processor was being held in reset. 
After the r command, the emulation status character is "U" which indicates the 
emulator is executing the user program. 
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Step 7. Trace demo program execution 

The t (trace) command tells the analyzer to look at the data on the emulation 
processor's bus and control signals at each clock cycle. The information seen at a 
particular clock cycle is called a state. 

When one of these states matches the "trigger state" you specify, the analyzer stores 
states in trace memory. When trace memory is filled, the trace is said to be 
"complete." 

The default trigger state specification is any state, so the t command will cause the 
analyzer to "trigger" on the first state it sees and store the following states in trace 
memory. 

1 Specify the trigger state as the starting address (main) of the demo program by 
entering the following tg command. 

U>tg addr=main:_main 

2 Start the trace by entering the t command. 

u>t 

Emulation trace started 



3 Run the demo program from the demo program's entry address by entering the 
following run command. 

U>r crtl: entry 

4 View the status of the trace by entering the ts command. 

U>ts 

Emulation Trace Status 

NEW User trace complete 

Arm ignored 

Trigger in memory 

Arm to trigger ? 

States 1024 (1024) -2.. 1021 

Sequence term 2 

Occurrence left 1 
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Notice that the trace is complete and that 1024 states have been stored. 

5 List the first twenty states stored in the trace (-t 20) and list symbols and addresses 
stored in the addr column (-e), by entering the following tl command. 



U>tl -e -t 20 



Line 


addr, H 


8018x mnemonic, H 




count , R 


-2 


19542 


6bH, 


mem write 




********* 


-1 


19543 


00H, 


mem write 




********* 


0 


_main 


55H, 


opcode fetch 


ROM 


********* 


1 


main 


PUSH BP 






********* 


2 


80001 


8bH, 


opcode fetch 


ROM 


********* 


3 


80002 


ecH, 


opcode fetch 


ROM 


********* 


4 


19540 


00H, 


mem write 




********* 


5 


19541 


00H, 


mem write 




********* 


6 


80001 


MOV BP, SP 






********* 


7 


80003 


leH, 


opcode fetch 


ROM 


********* 


8 


80003 


PUSH DS 






********* 


9 


80004 


b8H, 


opcode fetch 


ROM 


********* 


10 


80005 


09H, 


opcode fetch 


ROM 


********* 


11 


1953e 


00H, 


mem write 




********* 


12 


1953f 


10H, 


mem write 




********* 


13 


80004 


MOV AX, #1009H 




********* 


14 


80006 


10H, 


opcode fetch 


ROM 


********* 


15 


80007 


8eH, 


opcode fetch 


ROM 


********* 


16 


80007 


MOV DS,AX 






********* 


17 


80008 


d8H, 


opcode fetch 


ROM 


********* 



The first column in the trace list contains the line number. The trigger state is 
always on line number 0. 

The second column contains the address information associated with the trace 
states. Addresses in this column may be locations of instruction opcodes on fetch 
cycles, or they may be sources or destinations of operand cycles. The -e option in 
the tl command causes both addresses and symbols to appear in this column. 

The third column shows mnemonic information about the emulation bus cycle. 
The right edge of this column shows when ROM or monitor (MON) accesses are 
made. 

The next column shows the count information. The "R" indicates that each count is 
relative to the previous state. If the analyzer's maximum qualified clock speed is 
set to "fast" or if the count qualifier is turned off (the default), time counts cannot 
be displayed and this column will contain asterisks (*). 
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Step 8. Stop (break from) program execution 

The b command causes emulator execution to break from the user program into the 
emulation monitor program. 

The emulation monitor program is a program that is executed by the emulation 
processor that allows the emulator to access target system resources. For example, 
when you display target system memory locations, the monitor program executes 
80186 instructions that read the target memory locations and send their contents to 
the emulator. 

When the emulator is running the user program, commands that require access to 
target system resources will cause temporary breaks to the monitor program (unless 
the emulator is restricted to real time execution). 

When the emulator is running in the monitor program, it executes in a loop that 
waits for commands that require access to target system resources. 

• Break emulator execution out of the demo program and into the monitor program 
by entering the b command. 

U>b 

M> 

Notice that the emulation status character becomes "M" which indicates that the 
emulator is running in the monitor program. 
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Step 9. Display processor registers 

• Display the contents of the basic processor registers by entering the reg command. 
M>reg 

reg ax=000d bx=0060 cx=0037 dx=0134 bp=7eae si=0080 di=01f2 ds=1009 es=1009 
reg ss=1165 sp=7e48 ip=04b2 cs=8000 fl=f287 
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Step 10. Step through program execution 

The s command lets you step through user program execution. You can step single 
instructions or a number of instructions at a time. 



1 Step one instruction in the user program by entering the s command. 



M>s 

08000:004b3 - 
PC = 08000:003c0 



JMP NEAR PTR 03cOH 



2 Step eight instructions in the user program by entering the s 8 command. 



M>s 8 

08000:003c0 - 

08000:003c3 - 

08000:003c4 - 

08000:003c5 - 

08000:003c6 - 

08000:003ca - 

08000:003cb - 

08000:003cc - 
PC = 08000:003cf 



MOV AX, 05b8H 

NOP 

NOP 

NOP 

ADD AX, WORD PTR 05cOH 

NOP 

NOP 

MOV 05baH,AX 
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Step 11. Reset the emulator 

• Reset the emulator by entering the rst command. 

M>rst 

R> 

Notice that the emulation status character is "R" which shows that the emulator is 
being held in a reset state. 



If the emulator status character is unfamiliar 

The "R", "U", and "M" emulation prompt status characters are described in this 
chapter. If you see other emulation status characters, enter the es command for 
more information about the emulator status. 

• Display the emulator status information by entering the es command. 
R>es 

80C188XL: Emulation reset 
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User's Guide 

A complete set of task instructions and problem-solving guidelines, with a few 
basic concepts. 
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Using the Terminal Interface 



This chapter describes general tasks you may wish to perform while using the 
Terminal Interface, in other words, tasks that don't necessarily relate to using the 
emulator or the analyzer. These tasks are grouped into two sections: 

• Accessing HP 64700 system information. 



• Entering commands. 
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Accessing HP 64700 System Information 

The HP 64700' s Terminal Interface provides access to two types of system-wide 
information: 

• Help information for the Terminal Interface commands. 

• Software version number information for the products installed in the 
HP 64700 Card Cage. 



To access on-line help information 

• Use the help or ? commands. 

The HP 64700' s Terminal Interface provides an on-line help command to provide 
you with quick information on the various commands and command syntax. From 
any system prompt, you can enter help or ? as shown below. 

Commands are grouped into various classes. To see the commands grouped into a 
particular class, you can use the help command with that group. Viewing the group 
help information in short form will cause the commands or the grammar to be listed 
without any description. 

Help information exists for each command. Additionally, there is help information 
for each of the emulator configuration items. For example, to access the help 
information for the rrt configuration item, you can enter the help cf rrt command). 
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Examples To display information on the help command: 

M>help 

help - display help information 

help <group> - print help for desired group 

help -s <group> - print short help for desired group 

help <command> - print help for desired command 

help - print this help screen 



— VALID 


<group> NAMES 


gram 


- system grammar 


proc 


- processor specific grammar 


sys 


- system commands 


emul 


- emulation commands 


trc 


- analyzer trace commands 


xtrc 


- external trace analysis commands 




- all command groups 



To display information on the grammar used in the Terminal Interface: 

M>help gram 



gram - system grammar 



— SPECIAL CHARACTERS — 
# - comment delimiter 
{ } - command grouping 
Ctl R - command recall 



; - command separator 

"" - ascii string 

Ctl B - recall backwards 



Ctl C 



abort signal 
ascii string 



-- EXPRESSION EVALUATOR 

number bases : t-ten y-binary q-octal o-octal h-hex 

repetition and time counts default to decimal - all else default to hex 

operators: () -*/%+-<< <<< >> >>> & * I && 

-- PARAMETER SUBSTITUTION 

&token& - pseudo-parameter included in macro definition 

- cannot contain any white space between s pairs 

- performs positional substitution when macro is invoked 

Example 

Macro definition: mac getf ile= { load -hbs "transfer -t &file&"} 
Macro invocation: getfile MYFILE.o 

Expanded command: load -hbs "transfer -t MYFILE.o" 
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To display information specific to the 80186/188 processor: 

M>help proc 



Address format 

Memory addresses — 20 bit physical or 16:16 bit (seg:off) logical 
10 addresses — 16 bit physical 

Emulation Status Characters 

R - emulator in reset state 

U - running user program 

M - running monitor program 

W - waiting for CMB to become ready 

T - waiting for target system reset 

? - unknown state 

Equates for Analyzer Label stat 

inta, ior, iow, hit, of, mr, mw - 80xl8x status 

rom, grd - memory map status 

instr, bus - analyzer state status 

dma, proc, coproc - bus controller status 

usr, mon - user code/monitor status 

PCB register mnemonics 

irmx ints — iv, eoi, msk, pm, isr, irr, ist, tmrX, dmaX 
mstr ints — eoi, poll, psr, msk, pm, isr, irr, ist, tmr, dmaX, intX 
timers — crX, maX, mbX, mcX chip sels — umcs, lmcs, pacs, mmcs, mpcs 

dma — spX, dpX, cntX, ctlX reloc reg — rr 

enhanced mode registers — mdram, cdram, edram, pdcon (CMOS versions only) 



c - no target system clock 

r - target system reset active 

h - processor halted 

g - bus granted 

b - no bus cycles 
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To display information on the emulator commands: 

M>help emul 



emul 


- emulation commands 








b 


■break to monitor 


dump . . 


.dump memory 




. . run user code 


be 


.break condition 


es . . . . 


.emulation status 


reg . . 


. . registers 


bp. . . 


. breakpoints 


io . . . . 


. input / output 


rst . . 


. .reset 


cf 


. configuration 


ldprg . 


. load program 




. . run at CMB execute 


cim. . 


.copy target image 


load. . 


. load memory 


s . . . . 


. . step 


cmb . . 


.CMB interaction 




. memory 


ser . . 


. . search memory 


cov . . 


. coverage 


map . . . 


.memory mapper 






cp. . . 


. copy memory 




. modes 







To display information on the cf command: 

M>help cf 



cf - display or set emulation configuration 

cf - display current settings for all config items 

cf <item> - display current setting for specified <item> 

cf <item>=<value> - set new <value> for specified <item> 
cf <item> <item>=<value> <item> - set and display can be combined 

help cf <item> - display long help for specified <item> 

VALID CONFIGURATION <item> NAMES 

proc — set processor type (186EA, 188EA, 188EA, 186XL, 188XL) 

mon — select monitor option (bg, fg, ufg) 

loc — foreground monitor location (any 4K boundary) 

rrt — restrict to real time (en or dis) 

rad — physical run address default (maxseg or minseg) 
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To display information on the rrt configuration item: 

M>help cf rrt 

restrict to real time 

cf rrt=en tenable 
cf rrt=dis #disable 

When rrt=en and the emulator is running user code, the system 
refuses all commands that cause a break except rst, r and b. {eg. 
reg and memory commands that must access user memory) 

When rrt=dis, the system will accept commands normally. 

The rrt option can be used to prevent accidental breaks that might 
cause target system problems. 



45 



Chapter 2: Using the Terminal Interface 
Accessing HP 64700 System Information 



To display version information 



• Use the ver command. 

The Terminal Interface provides the ver command if you need to check the 
software version numbers of the HP 64700 system and other products in the 
HP 64700. 



Examples To display version information: 

M>ver 



Copyright (c) Hewlett-Packard Co. 1987 
All Rights Reserved. Reproduction, adaptation, or translation without prior 
written permission is prohibited, except as allowed under copyright laws. 

HP64700B Series Emulation System 
Version: B.01.00 20Dec93 
Location: Flash 
System RAM : 1 Mbyte 

HP64767A (PPN: 64767A) Intel 80C186EA Emulator 
Version: A. 00. 00 13Nov90 
Control: HP64748C ABC Control Board 
Speed: 20 MHz 

Memory: 1024 Kbytes 

HP64740 Emulation Analyzer with External State/Timing Analyzer 
Version: A. 02. 02 13Mar91 
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Entering Commands 

This section describes tasks that are related to entering commands. Entering 
commands is easy: use the keyboard to type in the command and press the carriage 
return key. However, the Terminal Interface provides other features that make 
entering commands even easier. For example, you can: 

• Enter multiple commands on one line. 

• Recall commands. 

• Edit commands. 

• Repeat commands. 

• Define macros, which save a set of commands for later execution. 

• Use command files over LAN. 



To enter multiple commands on one command 
line 

• Separate the commands with semicolons (;). 

More than one command may be entered in a single command line if the commands 
are separated by semicolons (;). 



Examples To step the next instruction and display the registers: 

M>s; reg 

081dc:00096 - CMP AL, ES : BYTE PTR [DI] 

PC = 081dc:00099 

reg ax=0220 bx=0160 cx=0039 dx=1009 bp=7e38 si=0007 di=0418 ds=1009 es=1009 
reg ss=1165 sp=7e36 ip=0099 cs=81dc fl=f246 
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To recall commands 

• Press <CTRL>r. 

You can press <CTRL>r to recall the commands that have just been entered. If you 
go past the command of interest, you can press <CTRL>b to move forward through 
the list of saved commands. 



Examples To recall and execute the last command press <CTRL>r and then press 

<RETURN>. 
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To edit commands 

1 Use the cl -e command to enable the command line editor. 

2 Use <CTRL>r to recall previous commands, or if you wish to edit the current 
command or search for a previous command, press <ESC> to enter the editing 
mode. 



The Terminal Interface provides a command line editing feature. The editing mode 
commands are as follows. 



Command 


Description 


<ESC> 


enter command editing mode 


i 


insert before current character 


a 


insert after current character 


X 


delete current character 


r 


replace current character 


dd 


delete command line 


D 


delete to end of line 


A 


append to end of line 


$ 


move cursor to end of line 


0 


move cursor to start of line 


A 


move cursor to start of line 


h 


move left one character 


1 


move right one character 


k 


fetch previous command 


j 


fetch next command 


/<string> 


find previous command in history matching <string> 


n 


fetch previous command matching <string> 


N 


fetch next command matching <string> 
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To repeat commands 

• Use the rep command. 

The rep command is helpful when entering commands repetitively. You can repeat 
the execution of macros as well as commands. 



Examples To cause the s and reg commands to be executed two times. 

M>rep 2 {s;reg) 



081dc:00073 - DEC SI 
PC = 081dc:00074 

reg ax=0220 bx=0160 cx=0039 dx=1009 bp=7e38 si=0006 di=0418 ds=1009 es=1009 

reg ss=1165 sp=7e36 ip=0074 cs=81dc fl=f206 

081dc:00074 - LES DI, DWORD PTR 06H[BP] 
PC = 081dc:00077 

reg ax=0220 bx=0160 cx=0039 dx=1009 bp=7e38 si=0006 di=02f0 ds=1009 es=1009 

reg ss=1165 sp=7e36 ip=0077 cs=81dc fl=f206 
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To enter multiple commands with macros 

1 Define the macro with the mac command. 

2 Execute the defined macro. 

If you wish to enter the same set of commands at various times while you use the 
emulator, you can assign these commands to a macro and enter the macro instead of 
the set of commands. 



Examples To define a macro that will display registers after every step, enter the following 

command. 

M>mac st={s;reg) 

To execute the macro, enter it as you would any other command. 

M>st 

# s ; reg 

081dc:00077 - INC WORD PTR 06H[BP] 
PC = 081dc:0007a 

reg ax=0220 bx=0160 cx=0039 dx=1009 bp=7e38 si=0006 di=02f0 ds=1009 es=1009 

reg ss=1165 sp=7e36 ip=007a cs=81dc fl=f202 
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To use command files over LAN 

1 Using ftp -in and the ftp command "cd <parameter>", copy information from the 
HP 64700 to the host computer. 

2 Using ftp -in and the ftp command "cd <parameter>", copy information from the 
host computer to the HP 64700. 

The ftp software in the HP 64700 responds to the ftp command "cd <parameter>" 
by executing the parameter as a Terminal Interface command. 

By using ftp -in (refer to the ftp documentation for option details), you can send 
multiple Terminal Interface commands to a HP 64700 on the LAN. 

For example, when entered from a UNIX workstation on the same LAN as the 
HP 64700 named hostname, the following command will display emulator version 
information: 

$ echo "open hostname\nverbose\ncd ver\nquit" | ftp —in 

If the Terminal Interface command you wish to execute has arguments, you must 
enclose the command and its arguments in quotes. For example: 

$ echo "open hostname\nverbose\ncd V'help ver\"\nquit" I ftp -in 

In order for these commands to work properly, there must not be an open telnet 
connection to the HP 64700. 



Examples The following example assumes the HP 64700 is connected to the same LAN as the 

UNIX host computer. 

To save the emulator configuration, memory map, and other emulator settings, 
create a configuration file by entering the following commands on the UNIX 
workstation: 

$ echo "open hostname" > cfg_file 

$ echo "open hostname\nverbose\ncd cf\ncd map\ncd equ\ncd mac\nquit" 
I ftp -in | grep ' " 'I awk ' {printf "cd \"%s\"\n", $0}' >> cfg_file 

$ echo "quit" >> cfg_file 

To restore the emulator configuration information saved in "cfg_file", enter the 
following command: 

$ ftp -in < cfg_file 
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This chapter describes the tasks you perform when plugging the emulator into a 
target system. These tasks are grouped into the following sections: 

• Connecting the emulator to the target system. 

• Configuring the emulator for operation with your target system. 

• Selecting the emulation monitor. 

• Mapping memory. 
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Connecting the Emulator to the Target System 

This section describes the steps you must perform when connecting the emulator to 
a target system: 

1 Turn OFF power. 

2 If the emulator is currently connected to the demo target system or a different 
target system, unplug the emulator probe. 

3 Set up the probe for the clock source. 

4 Connect the flying leads. 

5 Plug the emulator probe into the target system. 

6 Turn ON power (first the HP 64700, then the target system) . 



CAUTION Possible Damage to the Emulator Probe. The emulation probe contains devices 

that are susceptible to damage by static discharge. Therefore, precautionary 
measures should be taken before handling the microprocessor connector attached to 
the end of the probe cable to avoid damaging the internal components of the probe 
by static electricity. 

We STRONGLY suggest using a ground strap when handling the emulator 
probe. A ground strap is provided with the emulator. 
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Step 1 . Turn OFF power 



CAUTION Possible Damage to the Emulator. Make sure target system power is OFF and 

make sure HP 64700 power is OFF before removing or installing the emulator 
probe into the target system. 

Do not turn HP 64700 power OFF while the emulator is plugged into a target 
system whose power is ON. 



1 If the emulator is currently plugged into a different target system, turn that target system's power OFF. 



2 Turn emulator power OFF. 



Step 2. Unplug probe from demo target system 



1 If the emulator is currently connected to a different target system, unplug the emulator probe; 
otherwise, disconnect the emulator probe from the demo target system. 
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Step 3. Set up the probe for the clock source 

A 14-pin DIP socket located at the target connector end of the probe is used to 
prepare the emulator probe for the type of clock source in the target system. The 
figure below shows the connections that are made to the socket. 

Target System 
Vcc 



SKT_U_DIP 



Target System q_ 
OSCOUT 



Emulation Processor 
OSCOUT 




Target System 
CLKIN 



Emulation Processor 
CLKIN 



A jumper that connects the emulation processor OSCOUT and CLKIN pins to the 
OSCOUT and CLKIN pins on the target connector is provided. You can use this 
jumper if: 

• The target system drives CLKIN with an oscillator. 

• The target system has a low frequency crystal connected between the 
OSCOUT and CLKIN pins. 

However, if the target system has a high frequency crystal connected between the 
OSCOUT and CLKIN pins, you may have to replace the jumper with either a 
standard 14-pin oscillator of the desired frequency or a prototyping socket on which 
a crystal and any capacitors or tank circuitry are assembled. (One such prototyping 
socket is part number 20314-36-455 from Electronic Molding Corp., 96 Mill Street, 
Woonsocket RI.) 
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Parasitic circuit parameters in the emulator/target interconnect may cause problems 
when the target system uses a high frequency crystal. The frequency limit is very 
much dependent on the target system. Under favorable conditions, operation at full 
speed may be possible with the jumper. 

If you can use the provided jumper, go on to Step 4; otherwise, perform the 
following steps. 



1 Remove plastic rivets that secure the plastic cover on the top of the emulator probe, and remove the 
cover. 



9 




6i767E10 THESE TWO 

POSITIONS ONLY 



2 Replace the jumper with either a standard 14-pin oscillator of the desired frequency or a prototyping 
socket on which a crystal and any capacitors or tank circuitry are assembled. 
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Step 4. Connect the flying leads 



CAUTION Damage to the Emulator Probe Will Result if the Flying Leads Are Incorrectly 

Installed. When installing the flying leads into the emulator probe, make sure that 
the ground pin on the output line (labeled with a white dot) is matched with the 
ground receptacle in the emulator probe. The ground receptacle on the probe is 
indicated by a white dot on the PC board. 



1 If you will be using either the BACKGROUND or RESET flying lead, plug them into the probe and 
route them through the 14-pin socket hole in the plastic cover. 



HP 64767 

EMULATION 

PROBE 




If your target system checks for processor execution (for example, it has a 
watchdog timer) you can use the BGND auxiliary output to signal the target system 
when the emulator is executing in the background monitor. This may be necessary 
because the emulator appears idle (no bus status or control signals except ALE) 
while running in background mode. The BGND signal is low when the emulator is 
running in the background monitor and high in the normal foreground mode. This 
signal is labelled "LBG" on the probe board. 



59 



Chapter 3: Plugging into a Target System 
Connecting the Emulator to the Target System 



2 To connect the emulator in parallel with a soldered-in target processor (ONCE mode), connect the 
"LRES" flying lead from the emulator to the target system RESIN circuitry. 



This connection will allow the target system processor to see emulation RESETs and to correctly tri-state 
itself. The LRES signal from the emulation probe is an open drain output from a 74HCT03 device which 
is driven low whenever the emulation processor is RESET (due to an emulation command). This signal 
can be connected directly to an RC RESET network as shown, or to a target system open drain/collector 
output driving RESIN. The emulator does not provide any pullup on the LRES flying lead signal. 

FLYING LEAD 

CONNECTOR 



TARGET SYSTEM 



Vcc 



o 
o 




D _ 



-U 



GROUND 



EMULATOR PROBE 



_RES 




A 



74HCT03D 



GROUND 



_RESIN (processor input) 



64767B02 
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3 Replace the plastic cover, and insert new plastic rivets (supplied with the emulator) to secure the cover. 
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Step 5. Plug the 801 8x emulator probe into the 
target system 



1 (64767A/AL in PGA system) Install the 68-pin double header. Make sure that pin 1 of the connector 
aligns with pin 1 of the socket. Damage to the emulator will result if the probe is incorrectly installed. 




80186/8/XL/EA/EC 

EMULATOR 

PROBE 



MALE TO MALE 
HEADER 



PGA SOCKET 
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1 (64767A/AL in PLCC system) Plug the probe into the supplied PGA-PLCC adapter. The angled 
corner of the PLCC adapter should be located at the corner of the probe as shown. Make sure that pin 1 of 
the connector aligns with pin 1 of the socket. Damage to the emulator will result if the probe is 
incorrectly installed. 




80186/8/XL/EA 
EMULATOR PROBE 



PGA SOCKET 



PLCC CONNECTOR 
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1 (64767B/BL in PLCC system) Plug the probe into the supplied PGA-PLCC adapter. The angled 
corner of the PLCC adapter should be located at the corner of the probe as shown. Make sure that pin 1 of 
the connector aligns with pin 1 of the socket. Damage to the emulator will result if the probe is 
incorrectly installed. 




80186/8/EB 
EMULATOR PROBE 



PGA SOCKET 



PLCC CONNECTOR 
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1 (any 64767 in QFP or PQFP system) Install the adapter according to the instructions supplied with 
the adapter. Make sure that pin 1 of the connector aligns with pin 1 of the socket. Damage to the 
emulator will result if the probe is incorrectly installed. 

Note that when using the QFP adapter with the 64767 AJ AL it is important to use the 69-pin double 
header and to correctly locate the "extra" corner pin of the header. The location of the "extra" pin can be 
seen on the emulation probe PGA socket. 



2 Plug the flying lead into the target system. 
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Step 6. Turn ON power 



1 Turn emulator power ON. 



^^^^^ 
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Configuring for Operation with Your Target 
System 

After you plug the emulator into a target system and turn on power to the 

HP 64700, you need to configure the emulator so that it operates properly with your 

target system. 

Before the emulator can operate in your target system, you must: 

Map memory. Because the emulator can use target system memory or 
emulation memory (or both), it is necessary to map ranges of memory so that 
the emulator knows where to direct its accesses. Refer to the "Mapping 
Memory" section in this chapter. 

Also, the emulator needs to know the following things: 

Is there circuitry in the target system that requires programs to run in 
real-time? Some emulator commands cause temporary breaks to the monitor 
state, typically to access microprocessor register values or target system 
memory. If the target system requires that programs run in real-time, you 
must restrict the emulator to real-time runs. 

Should the emulator respond to target system interrupts when running in 
the monitor program? If so, you must use a foreground monitor program 
since target system interrupts are always ignored during background operation 
(refer to the "Selecting the Emulation Monitor" section later in this chapter). If 
it's not important that the emulator respond to target system interrupts when 
running in the monitor, you can use the background monitor. 

This section shows you how to: 

• Set the processor type. 

• Restrict to real-time runs. 

• Turn OFF the restriction to real-time runs. 

• Select the default physical to logical run address conversion. 
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To set the processor type 

For the HP 64767A emulator: 

• Enter the cf proc=186EA command to emulate the 80C 1 86EA microprocessor. 

• Enter the cf proc=188EA command to emulate the 80C 1 88EA microprocessor. 

• Enter the cf proc=186XL command to emulate the 80C186XL, 80C186, or 80186 
microprocessors. 

• Enter the cf proc=188XL command to emulate the 80C188XL, 80C188, or 80188 
microprocessors. 

For the HP 64767B emulator: 

• Enter the cf proc=186EB command to emulate the 80C186EB microprocessor. 

• Enter the cf proc=188EB command to emulate the 80C188EB microprocessor. 
For the HP 64767C emulator: 

• Enter the cf proc=186EC command to emulate the 80C186EC microprocessor. 

• Enter the cf proc=188EC command to emulate the 80C188EC microprocessor. 
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To restrict to real-time runs 

• Enter the cf rrt=en command. 

While running programs, temporary breaks to the monitor state are not allowed. 
The emulator refuses the following commands: 

• reg (register display/modification). 

• m (memory display/modification) commands that access target system 
memory. 

Because the emulator contains dual-port emulation memory, commands which 
access emulation memory are allowed while runs are restricted to real-time. 

• io (I/O display/modification). 

Caution Target system damage could occur! If your target system circuitry is dependent 

on constant execution of program code, the following commands still cause breaks 
from running programs even when you have restricted the emulator to real-time 
runs: 

• rst (reset). 

• r (run). 

• b (break to monitor). 

• s (step). 

Use caution in executing these commands. 



69 



Chapter 3: Plugging into a Target System 
Configuring for Operation with Your Target System 



To turn OFF the restriction to real-time runs 

• Enter the cf rrt=dis command. 

Temporary breaks to the monitor while running programs are allowed, and the 
emulator accepts commands normally. 



To select the default physical to logical run 
address conversion 

• Enter the cf rad=minseg command to cause the conversion to make the segment 
part of the logical address as small as possible. For example, OFFFFF becomes 
0F000:0FFFF. 

• Enter the cf rad=maxseg command to cause the conversion to make the segment 
part of the logical address as large as possible. For example, OFFFFF becomes 
0FFFF:000F. 

The run and step commands allow you to enter addresses in either logical form, that 
is "segmentioffset" (OFOOOiOFFFF, for example) or physical form (OFFFFF, for 
example). When you enter a physical address, the emulator must convert it to a 
logical (segmentioffset) address. The rad configuration item sets the default 
algorithm for this conversion. 

If neither of these default algorithms is suitable, you can enter addresses in logical 
format. 
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Selecting the Emulation Monitor Program 

The emulation monitor program is an 8018x program that the emulation 
microprocessor executes as directed by the HP 64700 system controller. The 
emulation monitor program gives the system controller access to the target system. 

For example, when you use the m command to modify target system memory, the 
system controller writes a command code to a communications area and switches, 
or breaks, emulation processor execution into the monitor program. The monitor 
program reads the command code (and any associated parameters) from the 
communications area and executes the appropriate machine instructions to modify 
the target system locations. After the monitor has performed its task, emulation 
processor execution returns to what it was doing before the break. 

The emulation monitor program can execute out of a separate, internal memory 
system known as background memory. A monitor program executing out of 
background memory is known as a background monitor program. 

The emulation monitor program can also execute out of the same memory system 
as user programs. This memory system is known as foreground memory and is 
made up of emulation memory and target system memory. A monitor program 
executing out of foreground memory is known as a foreground monitor program. 
The emulator only allows foreground monitor programs in emulation memory. 

The emulator firmware includes both background and foreground monitor 
programs and lets you select either. You can also load and use a customized 
foreground monitor if needed. 

This section shows you how to: 

• Select the background monitor program. 

• Select the foreground monitor program. 

• Use a customized foreground monitor program. 
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Comparison of Background and Foreground Monitor Programs 


Monitor Program Characteristic 


Background 


Foreground 


Takes up processor memory space 


No 


Yes 


Allows the emulator to respond to target system 
interrupts during monitor execution 


No 


Yes 


Can be customized 


No 


Yes 



To select the background monitor program 

1 Enter the cf mon=bg command. 

2 Re-map memory. 

3 Load the user program absolute file. 

When you power up the emulator, or when you initialize it, the background monitor 
program is selected by default. 
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To select the foreground monitor program 

1 Enter the cf mon=fg command to select a foreground monitor. 

2 Enter the cf loc=<addr>,lock or cf loc=<addr>,nolock command to select the base 
address of the monitor program and specify whether to lock foreground monitor 
bus cycles to the target RDY line. 

3 Re-map memory. 

4 Load the user program absolute file. 
Selecting the Foreground Monitor 

Entering the the cf mon=fg command causes the current memory map to be deleted. 

When you select a foreground monitor, the emulator automatically loads the default 
program, resident in emulator firmware, into emulation memory. The foreground 
monitor is reloaded every time the emulator breaks into the monitor state from the 
reset state. 

Unlike the background monitor, the foreground monitor runs within the same 
address space as the user program, consuming a 4 Kbyte block of the 80186's 
address range. The foreground monitor can run with target interrupts enabled. 

When a foreground monitor program is selected, breaks to the monitor program 
still cause a few cycles to execute in background. 

Selecting the Monitor's Base Address 

The cf loc=<addr> command defines the starting address of the 4 Kbyte block of 
emulation memory used for the foreground monitor. The address must reside on a 
4 Kbyte boundary (in other words, an address ending in 000H) and must be 
specified in hexadecimal. 

When you enter the cf loc=<addr> command, the current memory map will be 
deleted, and a new map term is added for the monitor. 

This configuration item has no meaning when a background monitor is selected. 
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Locking Foreground Cycles to Target RDY 

If you wish to synchronize monitor cycles to the target system (that is, interlock the 
emulation and target system RDY on accesses to the monitor memory block), enter 
the cf loc=<addr>,lock command; otherwise, enter the cf loc=<addr>,nolock or 
cf loc=<addr> command. 

This configuration item has no meaning when a background monitor is selected. 
Re-Mapping Memory 

When you configure the emulator for a foreground monitor program, the memory 
map is reset, and a 4 Kbyte block of emulation memory is automatically mapped 
for the monitor program. You must re-map other memory ranges before loading 
user programs. 
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To use a custom foreground monitor program 

1 Edit the monitor program source file. 

2 Assemble and link the foreground monitor program. 

3 Load the custom foreground monitor program absolute file with the load -f 
command. 

4 Enter the cf mon=ufg command to select a user foreground monitor. 

5 Enter the cf loc=<addr>,lock or cf loc=<addr>,nolock command to select the base 
address of the monitor program and specify whether to lock foreground monitor 
bus cycles to the target RDY line. 

6 Re-map memory. 

7 Load the user program absolute file. 

When customizing the foreground monitor, you must maintain the basic 
communication protocol between the monitor program and the emulation system 
controller. 

An example foreground monitor is included with the emulator on a MS-DOS 
format floppy disk. The file is named FM64767.S. 

A custom foreground monitor is downloaded using the load -f command. The 
custom foreground monitor is saved in the emulator (until the monitor type is 
changed) and reloaded every time the emulator breaks into the monitor state from 
the reset state. 



Note It is possible for foreground monitors to cause breaks. If these breaks occur 

consistently within approximately 10 ms of monitor entry, the emulator will 
become unresponsive. An example of this is a foreground monitor that accesses 
guarded memory. Each time a break to the monitor occurs, an access of guarded 
memory will occur, which in turn causes a break into the monitor, and so on. If this 
happens, you must turn off power to the emulator and turn it on again. 
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Examples The following examples of how to set up and use a custom foreground monitor 

program make the following assumptions: 

• The HP 64700 is connected to the same LAN as an HP 9000 Series 300 host 
computer. 

• The HP AxLS 8086/88/80186/188 Assembler/Linker and the HP 64855 
RS-232 Transfer products are installed on the HP 9000 Series 300 host 
computer. 

• The foreground monitor program source file exists on the host computer. 
To assemble and link the monitor program, enter the following commands: 

S as86 -Lh fm64767.s > fm64767.1is <RETURN> 



S ld86 -c fm64767.k -Lh > fm64767.map <RETURN> 



Where the "fm64767.k" linker command file contains: 

name fm64767 
load fm64767.o 
end 



To load the custom foreground monitor program: 

R>load -fhbs "transfer -tb fm64767.X" 

####### 



To load the monitor program and user program absolute files, enter the following 
commands from the host computer: 

$ ftp 15.35.226.210 
Connected to 15.35.226.210. 

220 User connected to HP64700 

Name ( 15 . 35 . 22 6 . 2 10 : guest ) : <RETURN> 

Password ( 15 . 35 . 22 6 . 2 10 : guest ) : <RETURN> 

ftp> binary 

200 Type set to I 

ftp> put fm64767.X -fh 

200 Port ok 

150 

226- 

R> 

226 Transfer completed 

3332 bytes sent in 0.20 seconds (16.27 Kbytes/sec) 
ftp> quit 

221 Goodbye 
$ 



To configure the emulator to use a foreground monitor program: 
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R>cf mon=ufg 

To specify the monitor's base address (without locking foreground monitor bus 
cycles to target RDY): 

R>cf loc=8000 

The memory map is reset and a 4 Kbyte block of emulation memory (range 8000H 
through 8FFFH) is mapped for the foreground monitor program. 

To map memory for the emulator demo program: 

R>map 0 . . 03f f erom 
R>map 10000.. If 3ff eram 
R>map 80000.. 8ffff erom 

To load the emulator demo program: 

$ ftp 15.35.226.210 
Connected to 15.35.226.210. 

220 User connected to HP64700 

Name ( 15 . 35 . 22 6 . 2 10 : guest ) : <RETURN> 

Password ( 15 . 35 . 22 6 . 2 10 : guest ) : <RETURN> 

ftp> binary 

200 Type set to I 

ftp> put ecs.X -h 

200 Port ok 

150 

226- 

R> 

226 Transfer completed 

3332 bytes sent in 0.20 seconds (16.27 Kbytes/sec) 
ftp> quit 

221 Goodbye 
$ 

Now, you are ready to use the emulator. 
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Mapping Memory 

Because the emulator can use target system memory or emulation memory (or 
both), it is necessary to map ranges of memory so that the emulator knows where to 
direct its accesses. 

Up to 16 ranges of memory can be mapped, and the resolution of mapped ranges is 
1 Kbytes (that is, the memory ranges must begin on 1 Kbyte boundaries and must 
be at least 1 Kbytes in length). 

The emulator contains 1 Mbytes of emulation memory. 

External direct memory access (DMA) to emulation memory is not permitted. The 
emulation processor's internal DMA modules can access emulation memory. 

You should map all memory ranges used by your programs before loading 
programs into memory. 



To map memory ranges 

• Use the map <range> <type> <attrib> command. 

The <type> parameter allows you to characterize the memory range as emulation 
RAM, emulation ROM, target system RAM, target system ROM, or as guarded 
memory. 

Guarded memory accesses will cause emulator execution to break into the monitor 
program. 

Writes to locations characterized as ROM will cause emulator execution to break 
into the monitor program if the rom break condition is enabled (be -e rom). 

Writes to emulation ROM will not modify memory. Writes by user code to target 
system memory locations that are mapped as ROM or guarded memory will result 
in a break to the monitor but are not inhibited (that is, the write still occurs). 

Emulation memory ranges can have an <attrib> parameter. The lock attribute 
specifies that emulation memory accesses in the range be synchronized to the target 
system RDY signal. The nolock attribute specifies that emulation memory 
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accesses are not synchronized to the target RDY — it is the same as specifying no 
attribute. 



Examples Consider the following section summary from the linker load map output listing. 

SEGMENT SUMMARY 



SEGMENT 


CLASS 


START 


END 


LENGTH 


ALIGNMENT 


COMBINE 


prog_main 


CODE 


80000 


80638 


00639 


Word 


Public 


lib 


CODE 


8063A 


81500 


00EC7 


Word 


Public 


prog_init_system 


CODE 


81502 


815AB 


000AA 


Word 


Public 


prog_update_sys 


CODE 


815AC 


819C4 


00419 


Word 


Public 


env 


CODE 


819C6 


81DCC 


00407 


Word 


Public 


libm 


CODE 


81DCD 


81DCD 


00000 


Byte 


Public 


libc 


CODE 


81DCE 


841E4 


02417 


Word 


Public 


data 




1009C 


10651 


005B6 


Word 


Public 


const 




845C2 


845F5 


00034 


Word 


Public 


??SEG 




00010 


00010 


00000 


Paragraph 


Public 


mm_check 




845C0 


845C1 


00002 


Byte 


Common 


envdata 




10000 


1000D 


0000E 


Byte 


Public 


libcdata 




10012 


1009B 


0008A 


Word 


Public 


idata 




10652 


10652 


00000 


Byte 


Public 


udata 




10652 


10652 


00000 


Byte 


Public 


heap 




10652 


11651 


01000 


Word 


Public 


userstack 




11652 


19551 


07F00 


Word 


Public 


libmconst 




845BD 


845BD 


00000 


Byte 


Public 


interrupt 




00000 


00003 


00004 


Abs . segment 


Private 


libcconst 




841E6 


845BC 


003D7 


Word 


Public 


libdata 




1000E 


10011 


00004 


Word 


Public 


??DATA1 


??INIT 


845BD 


845BF 


00003 


Byte 


Common 



Notice the absolute segment occupies locations 0 through 3. Because the contents 
of this segments will eventually reside in target system ROM, this area should be 
characterized as ROM when mapped. 

Notice the data segments occupy locations 10000H through 19551H. Since these 
sections are written to, they should be characterized as RAM when mapped. 

Notice the code and const segments occupy locations 80000H through 845F5H. 
Because the contents of the code and const segments will eventually reside in target 
system ROM, this area should be characterized as ROM when mapped. This will 
prevent these locations from being written over accidentally. If the rom break 
condition is enabled, instructions that attempt to write to these locations will cause 
emulator execution to break into the monitor. 

To map emulation memory for the above program, you would enter the following 
map commands. 
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R>map 0 . . 3f f erom 
R>map 10000.. 197ff eram 
R>map 80000.. 847ff erom 



To display the memory map 

• Enter the map command with no parameters. 



Examples To view the memory map, enter the map command with no parameters. 

R>map 

# remaining number of terms : 13 

# remaining emulation memory : flcOOh bytes 
map 000000 .. 0003ff erom # term 1 
map 010000 .. 0197ff eram # term 2 
map 080000 .. 0847ff erom # term 3 
map other tram 
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To characterize unmapped ranges 

• Enter the map other command. 

The default characterization for unmapped memory ranges are treated as target 
system RAM. 

You can also characterize unmapped ranges as emulation RAM, emulation ROM, 
target system ROM, or as guarded memory. 

When you characterize unmapped ranges as emulation memory, you can include 
the lock attribute, which specifies that emulation memory accesses be synchronized 
to the target system RDY signal, or you can include the nolock attribute, which 
specifies that emulation memory accesses are not synchronized to the target RDY 
(this is the same as specifying no attribute). 



Examples To characterize unmapped ranges as target RAM: 

R>map other tram 

To characterize unmapped ranges as guarded memory: 

R>map other grd 

To characterize unmapped ranges as emulation RAM: 

R>map other or am nolock 
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To delete memory map ranges 

• Enter the map -d command. 

Note that programs should be reloaded after deleting mapper terms. The memory 
mapper may re-assign blocks of emulation memory after the insertion or deletion of 
mapper terms. 



Examples To delete term 1 in the memory map: 

R>map -d 1 

To delete all map terms: 

R>map -d * 
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This chapter describes general tasks you may wish to perform while using the 
emulator. These tasks are grouped into the following sections: 

• Initializing the emulator. 

• Loading absolute files. 

• Loading and using symbols. 

• Executing user programs (starting, stopping, stepping, and resetting the 
emulator). 

• Using software breakpoints. 

• Enabling and disabling break conditions. 

• Accessing registers. 

• Accessing memory. 
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Initializing the Emulator 

This section shows you how to: 

• Initialize the emulator. 

• Display emulator status information. 



To initialize the emulator 

• To perform a limited initialization, enter the init command. 

• To perform a complete initialization without system verification, enter the init -c 
command. 



• To perform a complete initialization with system verification, enter the init -p 
command. 

• To perform a complete initialization without optional product verification, enter the 
init -r command. 

The init command with no options causes a limited initialization. A limited 
initialization does not affect system configuration. However, the init command 
will reset emulator and analyzer configurations. The init command: 

• Resets the memory map. 

• Resets the emulator configuration items. 

• Resets the break conditions. 

• Clears breakpoints. 
The init command does not: 

• Clear any macros. 
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• Clear any emulation memory locations; mapper terms are deleted, but if you 
re-specify the exact same memory map, you will find that the emulation 
memory contents are the same. 

The -c option specifies a complete initialization (except system verification tests are 
not run). 

The -p option specifies a complete initialization with system verification tests. The 
-p initialization sequence includes emulator, analyzer, system controller, 
communications port, LAN interface, and flash EPROM initialization. 

The -r option specifies a complete initialization with system verification tests (as 
with -p), but all optional products are ignored. Do not use flash ROM. 



Examples To perform a limited initialization: 

R>init 

# Limited initialization completed 
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To display emulator status information 



• Enter the es command, 
or 

• Enter the help proc command. 

The Terminal Interface prompt displays an emulator status character. You can find 
the meaning of the emulator status character in one of two ways: with the help proc 
command or with the es command. 



Examples 



To use the help proc command: 



R>help proc 



Emulation Status Characters 

R - emulator in reset state 

U - running user program 

M - running monitor program 

W - waiting for CMB to become ready 

T - waiting for target system reset 

? - unknown state 



c - no target system clock 

r - target system reset active 

h - processor halted 

g - bus granted 

b - no bus cycles 



To use the es command: 



R>es 

80C188XL: Emulation reset 



87 



Chapter 4: Using the Emulator 
Loading Absolute Files 



Loading Absolute Files 

This section describes the tasks related to loading absolute files into the emulator. 
You can load absolute files when using the serial connection or when using the 
LAN connection: 

• When using the serial connection, the HP 64700 is connected to a host 
computer and accessed via a terminal emulation program. In this 
configuration, you can load absolute files by downloading from the same port. 

• When using the LAN connection, the HP 64700 is connected to the same LAN 
as a computer that has the ARPA Services File Transfer Protocol (ftp) 
software. In this configuration, you can use the ftp command to load absolute 
files over the LAN. 

The Terminal Interface's load command will accept absolute files in the following 
formats: 

• HP absolute. 

• Intel hexadecimal. 

• Extended Tektronix hexadecimal. 

• Motorola S-records. 
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To load absolute files over the serial port 

• Load the file over the "command" port. 

If the emulator is connected to a host computer, and you are accessing the emulator 
from the host computer via a terminal emulation program, you can also download 
files with the load command. In this configuration, files are loaded from the same 
port that commands are entered from. 



Examples To download a Tektronix hexadecimal file from a Vectra personal computer: 

R>load -t <RETURN> 

After you have entered the load command, exit from the terminal emulation 
program to the MS-DOS operating system. Then, copy your hexadecimal file to 
the port connected to the emulator, for example: 

C:\copy thexfile coml : <RETURN> 

Now you can return to the terminal emulation program and verify that the file was 
loaded (for example, by displaying memory in mnemonic format). 



To load absolute files over the LAN 

• Use the ftp command on your local host computer to transfer files to the remote 
HP 64700. 

When connecting to the HP 64700' s ftp interface, you can use either the 
HP 64700' s hostname or the Internet Protocol (IP) address (or internet address). 
When you use the HP 64700' s hostname, the ftp software on your computer will 
look up the internet address in the hosts table, or perhaps a name server will return 
the internet address. 
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Examples To connect to the emulator's ftp interface, enter the following command (use any 

name and password): 

$ ftp 15.35.226.210 
Connected to 15.35.226.210. 
220 User connected to HP64700 
Name ( 15 . 35 . 22 6 . 2 10 : guest ) : 
Password ( 15 . 35 . 22 6 . 2 10 : guest ) : 
230- 

NOTICE 



This utility program is unsupported. It is provided at no cost. 
Hewlett-Packard makes no warranty on its quality or fitness for 
a particular purpose. 

FTP on the HP64700 serves as a means for downloading absolute files to the 
emulation environment. The file transfer can be be performed as follows: 

1. The data mode type must be set to IMAGE (binary) 

2. Store the file using options to indicate the file format. The following 
example uses PUT as the host command for sending the file. This may be 
different for your ftp implementation. 

put <file_name> <options> 

<file_name> - host file to be loaded. 

<options> - The options are preceeded by a minus (-) . The available 
options vary for individual emulators. All support HP OLS, Intel hex, 
Motorola S-records, and Extended Tek Hex. Emulator specific options can 
be viewed by issuing a Terminal Mode help for the load command. 

put hpfile.X -h #to download an HP OLS file 

put intelfile -i #to download an Intel Hex file 

put motfile -m #to download a Motorola S-record file 

put tekfile -t #to download an Extended Tek Hex file 



230 



To set up ftp for binary file transfers: 

ftp> binary 

200 Type set to I 



To download the HP 64000 format absolute file into the emulator: 

ftp> put ecs.X -h 

200 Port ok 

150 

226- 

R> 

226 Transfer completed 

3332 bytes sent in 0.20 seconds (16.27 Kbytes/sec) 



To exit out of the ftp interface: 

ftp> quit 
221 Goodbye 
$ 



90 



Chapter 4: Using the Emulator 
Loading and Using Symbols 



Loading and Using Symbols 

The emulator supports the use of symbolic references. The symbols can be loaded 
from an ASCII text file on a host computer or defined with the sym command. 

This section describes the tasks related to loading ASCII symbol files into the 
emulator. ASCII symbol files must be loaded from a host computer. 

Symbols will be shown when you display memory in mnemonic format. Also, you 
can use the -s or -e options to the trace list command (tl) to have symbolic 
information included in the trace list. 

You can typically use symbol table information from a linker map file when 
creating the ASCII symbol file; however, you need to make sure the information is 
in the following format. 

# 

: global_symbol 
module : local_symbol 



# 

This section describes how to: 

• Load symbol files over the serial port. 

• Load symbol files over the LAN. 

• Define user symbols. 

• Display symbols. 

• Remove symbols. 
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To load symbol files over the serial port 

• Use the load -S command. 

ASCII symbol files are loaded into the emulator with the load -S command. 



Examples Suppose the "ecs.sym" file below exists on a Vectra personal computer. 

# 

crtl:entry 0819C:0000A 

init_system:_init_system 08150 : 00002 

init_system:_init_val_arr 08150 : 00050 

main:_ascii_old_data 01009:00190 

main :_aver_temp 01009 :005A0 

main :_combsort 08000:002BB 

main :_curr_loc 01009:005AA 

main :_current_humid 01009:005A6 

main :_current_temp 01009 :005A4 

main :_do_sort 08000:00587 

main :_f loat_humid 01009:0059c 

main :_f loat_temp 01009:00598 

main :_func_needed 01009:005AC 

main :_gen_ascii_data 08000:00127 

main :_hdwr_encode 01009 :005AE 

main :_humid_dir 01009:005B0 

main :_interrupt_sim 08000:00032 

main:_main 08000:00000 

main :_num_checks 01009:005A8 

main:_old_data 01009:00000 

main:_strcpy8 08000:000D9 

main :_target_humid 01009:0018E 

main :_target_temp 01009:00180 

main :_temp_dir 01009:005B1 

update_sys :_get_targets 0815A: 00080 

update_sys :_read_conditions 0815A: 0013A 

update_sys :_save_points 0815A: 0031B 

update_sys :_set_outputs 0815A: 001BD 

update_sys :_update_system 0815A: 0000C 

update_sys :_write_hdwr 0815A: 00293 

# 

To load symbols from the ASCII file above: 

R>load -S <RETURN> 

After you have entered the load command, exit from the terminal emulation 
program to the MS-DOS operating system. Then, copy your symbols file to the 
port connected to the emulator, for example: 

C:\copy ecs.sym coml : <RETURN> 
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To load symbols over the LAN 

• Use the ftp command on your local host computer to transfer files to the remote 
HP 64700. 

Loading symbol files over the LAN is the same as loading absolute files over the 
LAN, except that a different option is used with the "put" command in ftp. 



Examples To connect to the emulator's ftp interface, enter the following command (use any 

name and password): 

$ ftp 15.35.226.210 
Connected to 15.35.226.210. 
220 User connected to HP64700 
Name ( 15 . 35 . 22 6 . 2 10 : guest ) : 
Password ( 15 . 35 . 22 6 . 2 10 : guest ) : 
230- 

NOTICE 

This utility program is unsupported. It is provided at no cost. 
Hewlett-Packard makes no warranty on its quality or fitness for 
a particular purpose. 



To set up ftp for binary file transfers: 

ftp> binary 

200 Type set to I 



To download the symbol file into the emulator: 

ftp> put ecs.sym -S 

200 Port ok 

150 

226- 

R> 

226 Transfer completed 

1789 bytes sent in 4.78 seconds (0.37 Kbytes/sec) 



To exit out of the ftp interface: 

ftp> quit 
221 Goodbye 
$ 
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To define user symbols 

• Use the sym <name>=<addr> command. 

You can use the sym command to define new symbols. 



Examples To define the symbol "while_statement" for the address 8000:0eH: 

R>sym while_statement=8000 : Oe 



To display symbols 

• Use the sym command. 

After symbols are loaded, you can use the sym command to display and delete 
symbols, as well as to define new symbols. 



Examples To display all the symbols: 

R>sym 

sym while_statement=08000 : OOOOe 

sym crtl:entry=0819c:0000a 

sym init_system:_init_system=08150 : 00002 

sym init_system:_init_val_arr=08150 : 00050 

sym main :_ascii_old_data=0 100 9 : 00190 

sym main :_aver_temp=01009 : 005a0 

sym main :_combsort=08000 : 002bb 

sym main :_curr_loc=0 100 9 : 005aa 

sym main :_current_humid=0 100 9 : 0 0 5a 6 

sym main :_current_temp=0100 9 : 005a4 

sym main :_do_sort=08000 : 00587 

sym main :_float_humid=0 100 9 : 005 9c 

sym main :_f loat_temp=01009 : 00598 

sym main :_func_needed=0100 9 : 0 0 5ac 

sym main :_gen_ascii_data=08000 : 0012 7 

sym main :_hdwr_encode=01009 : 005ae 

sym main :_humid_dir=01009 : 005b0 

sym main :_interrupt_sim=08000 : 00032 

sym main :_main=08000 : 00000 

sym main :_num_checks=01009 : 005a8 

sym main:_old_data=01009:0000c 

sym main:_strcpy8=08000:000d9 
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sym main :_target_humid=01009 : 0018e 
sym main :_target_temp=0100 9 :0018c 
sym main :_temp_dir=01009 : 005bl 
sym update_sys :_get_targets=0 815a :000 8c 
sym update_sys :_read_conditions=0 815a :0013a 
sym update_sys :_save_points=0815a : 0031b 
sym update_sys :_set_outputs=0815a : OOlbd 
sym update_sys :_update_system=0815a : 0000c 
sym update_sys :_write_hdwr=0815a : 00293 



To display all the global symbols: 

R>sym -g 

R> 



To display all the local modules: 

R>sym -1 

sym crtl: 

sym init_system: 

sym main: 

sym update_sys: 



To display all the user-defined symbols: 

R>sym -u 

sym while_statement=08000 : OOOOe 
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To remove symbols 

• Use the sym -d command. 

You can use the sym -d command to delete symbols. 



Examples To delete all user symbols: 

R>sym -du 

To delete all global symbols: 

R>sym -dg 

To delete all local symbols in all modules: 

R>sym -dl 

To delete all symbols: 

R>sym -d 
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Executing User Programs 

This section describes how to: 

• Start the emulator running the user (target system) program. 

• Stop (break from) user program execution. 

• Step through user programs. 

• Reset the emulation processor. 



To run (execute) user programs 

• Use the r command. 

The run command causes the emulator to execute the user program. When the 
emulator is executing the user program, the "U" emulator status character is shown 
in the Terminal Interface prompt. 

The r rst (run from reset) command specifies a run from target system reset. It is 
equivalent to entering a rst (reset) command followed by a r (run) command. The 
processor will be reset and then allowed to run. 

A r rst command can also be entered while the emulator is plugged into a 
powered-down target system. In this case, the emulator will run from the normal 
reset address (OFFFFOH) when the target system powers up and releases the 
RESET input. 



Examples To run from address "crtl:entry": 

R>r crtl: entry 

U> 

To run from the current program counter: 

M>r 

U> 
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To stop (break from) user program execution 

• Use the b command. 

You can use the break command (b) command to generate a break to the 
background monitor. 

The "Using Software Breakpoints" section of this chapter describes how to stop 
execution at particular points in the user program. 



Examples To break execution into the monitor: 

U>b 

M> 

To break from reset into the monitor: 

R>b 

M> 



To step through user programs 

• Use the s command. 

The emulator allows you to step through the user program. You can step from the 
current program counter (in other words, instruction pointer) or from a particular 
address. You can step a single instruction or a number of instructions. 

A step count of 0 will cause the stepping to continue "forever" (until some break 
condition, such as "write to ROM", is encountered, or until you enter <CTRL>c). 
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Examples To step one instruction from the current program counter: 



M>s 

08000:003ca - NOP 
PC = 08000:003cb 



To step a number of instructions from the current program counter: 

M>s 8 



08000 


003cb - 


NOP 


08000 


003cc - 


MOV 05baH,AX 


08000 


003cf - 


NOP 


08000 


003d0 - 


NOP 


08000 


003dl - 


NOP 


08000 


003d2 - 


MOV AX, #0007H 


08000 


003d5 - 


PUSH AX 


08000 


003d6 - 


MOV BX,WORD PTR 05baH 


PC = 08000:003da 





To step a number of instructions from a specified address: 



M>s 16 main:_main 

08000:00000 main:_main 

08000:00001 - 

08000:00003 - 

08000:00004 - 

08000:00007 - 

08150:00002 em:_init_system 

08150:00003 - 

08150:00005 - 

08150:00006 - 

08150:00009 - 

08150:00011 - 

08150:00017 - 

08150:0001d - 

08150:00023 - 

08150:00028 - 

08150:00029 - 

PC = 08150:0002e 



PUSH BP 

MOV BP, SP 

PUSH DS 

MOV AX, #1009H 

MOV DS,AX | CALL FAR PTR init_system 

PUSH BP 

MOV BP, SP 

PUSH DS 

MOV AX, #1009H 

MOV DS,AX | MOV 018cH,#0049H 
MOV WORD PTR 018eH,#002dH 
MOV WORD PTR 05a4H,#0044H 
MOV WORD PTR 05a6H,#0029H 
MOV BYTE PTR 05blH,#00H 
NOP 

MOV BYTE PTR 05b0H,#00H 
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To step until <CTRL>c: 

M>s 0 

08150:0002e - 

08150:0002f - 

08150:00034 - 

08150:00035 - 

08150:0003b - 



NOP 

MOV BYTE PTR 05acH,#00H 
NOP 

MOV WORD PTR 05aeH,#0000H 
MOV WORD PTR 05a8H,#0000H 



<CTRL>c 



08150:0006a - MOV AX, #000cH 

08150:0006d - MUL SI 

08150:0006f - XCHG AX,BX 

08150:00070 - MOV WORD PTR OOOeH [BX] , #0029H 

08150:00076 - MOV AX, #000cH 
PC = 08150:0007b 

! STATUS 685! Stepping aborted 



To reset the emulation processor 

• Use the rst command. 

The rst command causes the processor to be held in a reset state until a b (break), r 
(run), or s (step) command is entered. A CMB execute signal will also cause the 
emulator to run if reset. Also, a request to access target memory while reset will 
cause a break into the monitor. 

The -m option to the rst command specifies that the emulator begin executing in 
the monitor after reset. 



Examples To reset the emulation processor: 



U>rst 

R> 



To reset the emulation processor and break into the monitor: 



U>rst -m 

M> 
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Using Software Breakpoints 

Software breakpoints provide a way to accurately stop the execution of your 
program at selected locations. (Another way is to break user program execution on 
the analyzer trigger.) 



Note Version A.04.00 or greater of the HP 64700 system firmware provides support for 

permanent as well as temporary breakpoints. If your version of HP 64700 system 
firmware is less than A.04.00, only temporary breakpoints are supported. 



Software breakpoints are handled by the 80186/188 single byte interrupt (SBI) 
facility. When you define or enable a software breakpoint, the emulator will 
replace the opcode at the software breakpoint address with a breakpoint interrupt 
instruction (INT 3). 

When the INT 3 instruction executes, the emulator determines whether the SBI was 
generated by an enabled software breakpoint or by a single-byte interrupt 
instruction in your target program. 

If the SBI was generated by a software breakpoint, execution breaks to the monitor, 
and the breakpoint interrupt instruction (INT 3) is replaced by the original opcode. 
A subsequent run or step command will execute from this address. 

If the SBI was generated by a single -byte interrupt instruction in the target system, 
execution still breaks to the monitor, and an "undefined breakpoint" status message 
is displayed. To continue with program execution, you must run or step from the 
target program's breakpoint interrupt vector address. 

A valid user stack must exist to use breakpoints. In other words, SS and SP must 
be correctly initialized before a breakpoint is executed. 

Execution of the INT 3 instruction will cause an opcode fetch from the address 
pointed to by entry 3 (doubleword address at 0CH) in the vector table. Make sure 
that this address is mapped as something other than guarded memory. 

Note that you must only set software breakpoints at memory locations which 
contain instruction opcodes (not operands or data). 

Also, in order to successfully set a software breakpoint, the emulator must be able 
to write to the memory location specified. Therefore, software breakpoints cannot 
be set in target ROM. You can, however, copy target ROM into emulation memory 



101 



Chapter 4: Using the Emulator 
Using Software Breakpoints 



(see "To copy a target system memory image" in the "Accessing Memory" section 
of this chapter). 

This section shows you how to: 

• Enable the breakpoints feature. 

• Set permanent software breakpoints. 

• Set temporary software breakpoints. 

• Display software breakpoints. 

• Enable software breakpoints. 

• Disable software breakpoints. 

• Remove software breakpoints. 

• Disable the breakpoints feature. 

Caution Software breakpoints should not be set, cleared, enabled, or disabled while the 

emulator is running user code. If any of these commands are entered while the 
emulator is running user code, and the emulator is executing code in the area where 
the breakpoint is being modified, program execution may be unreliable. 



To enable the breakpoints feature 

• Enter the be -e bp command. 

Currently defined breakpoints are not automatically enabled when you enable the 
breakpoints feature; you must explicitly enable the software breakpoints. 
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To set permanent software breakpoints 

• Use the bp -p <addr> command. 

Permanent breakpoints are available if your version of HP 64700 system firmware 
is A.04.00 or greater. 

Permanent breakpoints remain enabled when encountered. You can disable or 
remove permanent breakpoints when you no longer want to break program 
execution at their addresses. 



Examples To set a permanent software breakpoint at address "update_sys:_update_system": 

M>bp -p update_sys :_update_system 



To set temporary software breakpoints 

• Use the bp <addr> or bp -t <addr> <count> commands. 

The bp -t <addr> <count> command is available if your version of HP 64700 
system firmware is A.04.00 or greater. If no <count> parameter is supplied, 1 is 
assumed. 

Temporary breakpoints are disabled, or the count is decremented, when the 
breakpoint is encountered. 
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Examples To set a temporary software breakpoint at address "update_sys:_update_system": 

M>bp update_sys :_update_system 

To set a temporary software breakpoint at address "update_sys:_update_system" 
that becomes disabled after the third occurrence of the address: 

M>bp -t update_sys :_update_system 3 



To display software breakpoints 

• Enter the bp command with no options or enter the bp -v command to display the 
breakpoints list verbosely. 

The software breakpoints list also shows whether the breakpoint feature is enabled 
or disabled. 

The bp -v command, available if your version of HP 64700 system firmware is 
A.04.00 or greater, shows the command option used when setting the breakpoint 
and, for temporary breakpoints, the count remaining. 



Examples To display the software breakpoint list: 

M>bp 

### BREAKPOINT FEATURE IS ENABLED ### 
bp 0815a:0000c #enabled 



To enable software breakpoints 

• Use the bp -e <addr> command. 

When a breakpoint is hit, it becomes disabled. You can use the -e option to the bp 
command to re-enable the software breakpoint. 
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Examples To enable the software breakpoint at "update_sys:_update_system": 

M>bp -e update_sys :_update_system 

To enable all software breakpoints: 
M>bp -e * 



To disable software breakpoints 

• Use the bp -d <addr> command. 

When a breakpoint is hit, it becomes disabled. You can also disable breakpoints 
before they are hit (while they are enabled) by using the -d option to the bp 
command. 



Examples To disable the software breakpoint at "update_sys:_update_system": 

M>bp -d update_sys :_update_system 



To remove software breakpoints 

• Use the bp -r <addr> command. 

You can remove existing breakpoints by using the -r option to the bp command. 



Examples To remove the software breakpoint at "update_sys:_update_system" from the 

breakpoint list: 

M>bp -r update_sys :_update_system 
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To disable the breakpoints feature 

• Enter the be -d bp command. 

All breakpoints are disabled, but they remain defined. 
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Using Break Conditions 

Break conditions allow you to specify breaks in the user program when certain 
events occur during emulation processor execution. 

The be command lets you enable or disable breaks on the following conditions: 

• Writes to ROM. 

• Analyzer trigger. 

(You can also break user program execution when certain events occur in another 
HP 64700; these break conditions are described in the "Making Coordinated 
Measurements" chapter.) 



To break on writes to ROM 

• Enter the be -e rom command. 

When the rom break condition is enabled, the emulator will break from user 
program execution when a write occurs to a memory location mapped as ROM. 



Examples To enable breaks on writes to ROM: 

M>bc -e rom 

To disable breaks on writes to ROM: 

M>bc -d rom 

When disabled, the emulator will not break to the monitor upon a write to ROM; 
however, it will not modify the memory location if the memory at that location is 
emulation ROM. 
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To break on an analyzer trigger 

1 Specify internal signal for analyzer to drive. 

2 Enable the emulator break on the internal signal. 

Use the tgout (trigger output) command to specify which signal is driven when the 
emulation analyzer triggers. 

Use the xtgout (external trigger output) command to specify which signal is driven 
when the external analyzer, configured as an independent state analyzer, triggers. 

Either the "trigl" or the "trig2" internal signals can be driven on the trigger. 

Note that the actual break may be several cycles after the analyzer trigger. 

After the break occurs, the analyzer will stop driving the trig line that caused the 
break. Therefore, if trig2 is used both to break and to drive the CMB TRIGGER 
(for example), TRIGGER will go true when the trigger is found and then will go 
false after the emulator breaks. However, if trig2 is used to cause the break and 
trigl is used to drive the CMB TRIGGER, TRIGGER will stay true after the 
trigger until the trace is halted or until the next trace starts. 



Examples To break on the emulation analyzer trigger (over the internal trig2) signal: 

M>tg any 
M>tgout trig2 
M>bc -e trig2 
M>r crtl: entry 

U>t 

Emulation trace started 
! AS YNC_STAT 619! trig2 break 
M>es 

80C188XL: Running in monitor — Last entry type= emulation break 
M> 
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To break on the external analyzer trigger (over the internal trig2) signal: 

M>xtmo -s 
M>xtg any 
M>xtgout trig2 
M>bc -e trig2 
M>r crtl: entry 
U>xt 

External trace started 
!ASYNC_STAT 619! trig2 break 
M>es 

80C188XL: Running in monitor — Last entry type= emulation break 
M> 



To disable breaks on the internal trig2 signal: 

M>bc -d trig2 
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Accessing Registers 

This section describes tasks related to displaying and modifying emulation 
processor registers. 

You can display the contents of an individual register or of all the registers. 

Refer to the reg command description in the "Commands" chapter for a description 
of the 80186 registers. 



To display register contents 

• Use the reg command. 

When displaying registers, you can display classes of registers and individual 
registers. 



Examples To display the basic register contents: 

M>reg 

reg ax=f21b bx=0174 cx=f216 dx=0cl2 bp=7ef0 si=0cl4 di=a454 ds=b8c0 es=9880 
reg ss=1165 sp=0c00 ip=4000 cs=0000 fl=f086 

To display the PCS registers: 
M>reg pes 

reg umcs=fffb lmcs=0038 pacs=0038 mmcs=01f8 mpcs=8038 

To display the PIC registers: 
M>reg pic 

reg pollsts=0000 imask=00fd primsk=0007 inserv=0000 reqst=0000 intsts=0000 
reg tcucon=000f dma0con=000f dmalcon=000f i0con=000f ilcon=000f i2con=000f 
reg i3con=000f 
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To modify register contents 

• Use the reg <reg>=<value> command. 



Examples To modify register DX to contain the value 0: 

M>reg dx=0 
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Accessing Memory 

This section describes the tasks related to displaying, modifying, copying, and 
searching the contents of memory locations. 

You can display and modify the contents of memory in byte, word, and long word 
lengths. You can also display the contents of memory in assembly language 
mnemonic format. 

When displaying memory, the display mode specifies the format of the memory 
display. When modifying memory, the display mode specifies the size of the 
location to be modified. 

When accessing target memory locations, the access mode specifies the type of 
microprocessor cycles that are used to read or write the value(s). 

This section describes the following tasks: 

• Setting the display and access modes. 

• Displaying memory contents. 

• Modifying memory contents. 

• Copying memory contents. 

• Searching memory for data. 

• Coping a target system memory image into emulation memory. 
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To set the display and access modes 

• Use the mo command. 

When displaying memory, the display mode specifies the format of the memory 
display. 

When modifying memory, the display mode specifies the size that the data is to be 
interpreted as. For example, suppose you modify a memory location with the value 
41H; in the byte display mode, the value is 41H, but in the word display mode, the 
value is 0041H, and in the long word display mode the value is 00000041H. 

When accessing target system memory locations, the access mode specifies the type 
of microprocessor cycles that are used to read or write the value(s). For example, 
when the access mode is byte and a target system location is modified to contain 
the value 12345678H, byte instructions are used to write the byte values 12H, 34H, 
56H, and 78H to target system memory. 

You can also specify the display and access modes in the m command, which is 
used to display and modify memory locations. 



Examples To display the display and access mode settings: 

M>mo 

mo -ab -dw 

To specify the double word display mode: 

M>mo -dd 

To specify the word access mode: 

M>mo -aw 
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To display memory contents 



• Use the m command. 



The m command displays the contents of the address or address range specified. 
Also, you can specify display and access modes with the -d and -a options. 

For viewing code in memory, the m -dm command displays memory contents in 
disassembled mnemonic format. 



Examples To display the byte contents of a memory location: 

M>m -db main:_ascii_old_data 

01009:00190.-01009:00190 20 



To display the contents of a range of memory locations: 

M>m -dw main :_ascii_old_data . . 



01009: 


:00190. 


.01009: 


:0019f 


2020 


2020 


3520 


0021 


2020 


2020 


3420 


00f7 


01009: 


: OOlaO . 


.01009: 


: OOlaf 


2020 


2020 


3520 


0031 


2020 


2020 


3520 


0034 


01009: 


: OOlbO . 


.01009: 


: OOlbf 


2020 


2020 


3520 


0032 


2020 


2020 


3520 


0030 


01009: 


: OOlcO . 


.01009: 


: OOlcf 


2020 


2020 


3520 


0031 


2020 


2020 


3520 


0036 


01009: 


: OOldO . 


.01009: 


: OOldf 


2020 


2020 


3520 


0034 


2020 


2020 


3520 


0031 


01009: 


: OOleO . 


.01009: 


: OOlef 


2020 


2020 


3520 


0033 


2020 


2020 


3520 


0035 


01009: 


: OOlf 0 . 


.01009: 


: OOlf f 


2020 


2020 


3520 


0035 


2020 


2020 


3520 


0036 


01009: 


: 00200 . 


.01009: 


0020f 


2020 


2020 


3520 


0034 


2020 


2020 


3620 


0037 



To display the range "main" through "main+lFH" in mnemonic format: 



M>m -dm 


main : 


_main . 


. main:_main+lf 


08000: 


:00000 


main 


:_main PUSH BP 


08000: 


:00001 




MOV BP, SP 


08000: 


:00003 




PUSH DS 


08000: 


:00004 




MOV AX, #1009H 


08000: 


:00007 




MOV DS,AX | CALL FAR PTR init_system 


08000: 


:0000e 




NOP 


08000: 


: OOOOf 




CALL FAR PTR update_sys :_update_s 


08000: 


: 00014 




INC WORD PTR 05a8H 


08000: 


: 00018 




MOV DX, #1009H 


08000 : 


: 0001b 




NOP 


08000: 


: 0001c 




MOV AX, #05a8H 


08000: 


:0001f 




NOP 



114 



Chapter 4: Using the Emulator 
Accessing Memory 



To modify memory contents 

• Use the m <addr>=<value> command. 

You can modify the contents of a memory location or a range of memory locations. 
Also, you can specify display and access modes with the -d and -a options. 



Examples To modify the location "main:_ascii_old_data" with a byte value of 41H: 

M>m -db main:_ascii_old_data=41 
M>m -db main:_ascii_old_data 

01009:00190.-01009:00190 41 

To modify the range of locations from "main:_ascii_old_data" through 
"main:_ascii_old_data+7FH" with byte values of 41H, 42H, 43H, and 44H: 

M>m -db main :_ascii_old_data . . =41 , 42 , 43 , 44 
M>m -db main:_ascii_old_data. . 

01009:00190. .01009:0019f 41 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 

01009:001a0. .01009:001af 41 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 

01009:001b0. .01009:001bf 41 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 

01009:001c0. .01009:001cf 41 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 

01009:001d0. .01009:001df 41 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 

01009:001e0. .01009:001ef 41 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 

01009:001f0. .01009:001ff 41 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 

01009:00200. .01009:0020f 41 42 43 44 41 42 43 44 41 42 43 44 41 42 43 44 
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To copy memory contents 

• Use the cp command. 

The cp (copy memory) command gives you the ability to copy the contents of one 
range of memory to another. This is a handy feature to test whether programs are 
relocatable, etc. 



Examples To copy the range of memory locations from OH through 7FH to 

"main:_ascii_old_data" : 

M>cp main:_ascii_old_data=0 . . 7f 



To search memory 

• Use the ser command. 

The ser command allows you to search for data in a range of memory locations. If 
any part of the data specified in the ser command is not found, no match is 
displayed. 



Examples To search the range of memory from "main:_ascii_old_data" through 

"main:_ascii_old_data+3FFH" for the ASCII string "CLEARED": 

M>mo -db 

M>ser main:_ascii_old_data. .main:_ascii_old_data+3ff="CLEARED" 

pattern match at address: 01009:00438 
pattern match at address: 01009:00440 
pattern match at address: 01009:00448 



M>ser main :_ascii_old_data . .main :_ascii_old_data+3f f =" Cleared" 

M> 

Notice that if the string is not found, no information is returned. 
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To copy a target system memory image 

1 Map the range of target memory you want to copy as emulation RAM. 

2 Use the cim command to copy the target memory contents into emulation memory. 

The cim command allows you to copy target ROM contents into emulation 
memory where you can set software breakpoints, perform coverage testing, or patch 
code by modifying memory contents. 

Note that if the target system hardware requires the 8018x chip select lines to 
access the desired memory, the appropriate chip select control registers have to be 
initialized before executing the cim command. 



Examples To copy the range of target ROM from 10000H through 1FFFFH: 



R>map 10000 . . If f f f erom 
R>cim 10000. .lffff 
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Using the Emulation Analyzer - Easy 
Configuration 



This chapter describes tasks you may wish to perform while using the emulation 
analyzer in its "easy" configuration (the "Using the Emulation Analyzer - Complex 
Configuration" chapter describes how to access and use the full capability of the 
analyzer). These tasks are grouped into the following sections: 

• Initializing the analyzer. 

• Qualifying the analyzer clock. 

• Starting and stopping trace measurements. 

• Displaying trace lists. 

• Qualifying trigger and store conditions. 

• Using the sequencer. 

• Using tag memory. 
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Initializing the Analyzer 

This section describes how to: 

• Initialize the analyzer. 

• Display trace activity. 

• Arm (activate) the emulation analyzer when the external analyzer triggers. 



To initialize the analyzer 

• Enter the tinit command. 

The tinit command initializes the analyzer to its default or power-up state. 

Examples To initialize the analyzer: 

U>tinit 



To display trace activity 

• Enter the ta command. 

The ta (trace activity) command allows you to display the current status of the 
analyzer trace signals. The trace activity display shows the status of trace signals at 
any time, regardless of whether a pending trace is completed or not. 

The trace signals are displayed in sets of sixteen. Pod 1 represents emulation 
analyzer trace signals 0 through 15 (the least significant bit is on the right). Pod 2 
represents emulation analyzer trace signals 16 through 31, and so on. External Pod 
represents the external analyzer trace signals. 
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A trace signal is displayed as a low (0), high (1), or moving (?). For the external 
analyzer, low means below the threshold voltage (as specified by the xtv 
command), and high means above the threshold voltage. 



Examples To display the activity on the analyzer trace signals: 



U>ta 

Pod 4 — ???????? ???????? 

Pod 3 — ???????? ???????? 

Pod 2 = 7117101? 11?????? 

Pod 1 — ???????? ???????? 

External pod = 00000000 00000000 



To arm the emulation analyzer with the external 
analyzer trigger 

• Use the tarm command. 

You can arm (that is, activate) the emulation analyzer when the external analyzer 
finds its trigger condition. The connection between the emulation analyzer and the 
external analyzer is made over one of the emulator's internal trigger signals (trigl 
or trig2). You set up the external analyzer to drive the internal trigger signal when 
it finds its trigger condition, and you use the tarm command to arm the emulation 
analyzer when the internal trigger signal appears. 



Examples To arm the emulation analyzer with the external analyzer's trigger output, over the 

internal trig2 signal, and trigger when the arm goes true: 

M>xtmo — s 
M>xtgout trig2 
M>tarm =trig2 
M>tg arm 
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Qualifying the Analyzer Clock 

The emulator/analyzer interface looks at the data on the emulation processor's bus 
and control signals at each clock cycle. This interface generates clocks to the 
analyzer. Address, data, and status fields which are then clocked into the analyzer. 

You can qualify the analyzer clock so that the analyzer only looks at background 
cycles. It's even possible to qualify the analyzer clock so that the analyzer only 
looks at bus cycles when some external signal is active. 

This section describes how to: 

• Qualify the analyzer clock to trace background execution. 

• Qualify the analyzer clock to trace only when an external signal is active. 



To trace background cycles 

• Enter the tck -b command. 

By default, the analyzer traces user (that is, foreground) code; this is specified by 
the -u option to the tck command. However, it is possible to trace background 
code; this is specified by the -b option to the tck command. 

You can trace both user and background code by specifying the -ub option in a 
single tck command. 



Examples To trace background cycles: 

u>tck -b 

U>tck 

tck -r L -b -s F 

Notice that the user/background option is a switch in the clock specification. 
Changing the option as shown above does not affect the rest of the trace clock 
specification. 
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To trace foreground and background cycles: 
u>tck -ub 

U>tck 

tck -r L -ub -s F 

To return to tracing foreground execution: 

U>tck -u 
U>tck 

tck -r L -u -s F 



To trace execution when an external signal is 
active 

1 Connect the external analyzer JCL or KCL line to the external signal. 

2 Use the tck command to specify the clock qualifier. 

It may occasionally be useful to use an external clock signal (either the JCL or KCL 
inputs to the external analyzer) to qualify the emulation analyzer clock signal. In 
other words, the emulation analyzer clock signal may only clock the analyzer when 
the qualifying clock signal is true. (This is how the analyzer provides the capability 
of tracing only user program execution or only background execution.) 

Clock signals are qualified by using the -1 and -h options to the tck command. 

The -1 option is used to specify a qualifying signal which only allows the trace to 
clock when this signal is lower than the threshold voltage. 

The -h option is used to specify a qualifying signal which only allows the trace to 
clock when this signal is higher than the threshold voltage. 

Note that you must specify the external analyzer threshold voltage before 
qualifying the emulation analyzer clock with an external signal. 

Note also that if several clock qualifiers are specified, the analyzer will be clocked 
if any one is true. This means you must turn off the user/background qualifier; in 
other words, tck -ub. 
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Qualifier setup time is approximately 25 nanoseconds when the external analyzer is 
aligned with emulation analyzer, (xtmo -e). Qualifier setup time is approximately 
20 nanoseconds when the external analyzer operates as an independent state 
analyzer (xtmo -s). Qualifier hold time is approximately 5 nanoseconds. 



Examples To trace execution only when there is a TTL high value on the external analyzer's J 

clock input: 

U>tinit 
U>tck -ub 
U>xtv -1 TTL 
U>tck -h J 
U>t 



To trace execution only when there is a CMOS low value on the external analyzer's 
K clock input: 

U>tinit 
U>tck -ub 
U>xtv -u CMOS 
U>tck -1 K 
U>t 



125 



Chapter 5: Using the Emulation Analyzer - Easy Configuration 
Starting and Stopping Traces 



Starting and Stopping Traces 

This section describes the tasks that relate to starting and stopping trace 
measurements. 

When you start a trace measurement, the analyzer begins looking at the data on the 
emulation processor's bus and control signals on each analyzer clock signal. The 
information seen on a particular clock is called a state. 

When one of these states matches the "trigger state" you specify, the analyzer stores 
states in trace memory. When trace memory is filled, the trace is said to be 
"complete." 

The default trigger state specification is "any state," so when you start a trace 
measurement after initializing the analyzer, the analyzer will "trigger" on the first 
state it sees and store the following states in trace memory. 

Once you start a trace measurement, you can view the progress of the measurement 
by displaying the trace status. 

In some situations, for example, when the trigger state is never found or when the 
analyzer hasn't filled trace memory, the trace measurement does not complete. In 
these situations, you can halt the trace measurement. 

This section describes how to: 

• Start trace measurements. 

• Display the trace status. 

• Halt trace measurements. 
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To start a trace measurement 

• Enter the t command. 

The t (trace) command tells the analyzer to begin monitoring the states which 
appear on the trace signals. You will see a message which confirms that a trace is 
started. 

After the emulator is powered-up or initialized, the analyzer is in its simplest 
configuration. The default condition will trigger on any state, and store all captured 
states. You can simply issue a trace command (t) to trace the states currendy 
executing. 



Examples To start a trace measurement after analyzer initialization: 

U>tinit 

U>t 

Emulation trace started 

To trace a program as it starts up: 

U>rst 

R>t 

Emulation trace started 
R>r crtl: entry 

U> 
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To display the trace status 

• Enter the ts command. 

The ts (trace status) command lets you view what the analyzer is doing (or what the 
analyzer has done if the trace has completed). 

The first line of the emulation trace status display shows whether the user trace has 
been "completed"; other possibilities are that the trace is still "running" or that the 
trace has been "halted". The word "NEW" indicates that the most recent trace has 
not been displayed. The word "User" indicates that the trace was taken in response 
to a t command; the other possibility is that a "CMB" execute signal started the 
trace. 

The second line of the ts display contains information on the arm condition. If the 
tarm condition is specified as always, the message "Arm ignored" is displayed. If 
the tarm condition is specified as one of the internal signals, either the message 
"Arm not received" or "Arm received" is displayed. The display indicates if the 
arm condition happened any time since the most recent trace started, even if it 
happened after the trace was halted or became complete. 

When an arm condition has been specified with the tarm command, the "Arm to 
trigger" line displays the amount of time between the arm condition and the trigger. 
The time displayed will be from -0.04 microseconds to 41.943 milliseconds, less 
than -0.04 microseconds, or greater than 41.943 milliseconds. If the arm signal is 
ignored or the trigger is not in memory, a question mark (?) is displayed. 

The "States" line shows the number of states that have been stored (out of the 
number that is possible to store) and the line numbers that the stored states occupy. 
(The trigger state is always stored on line 0.) 

The "Sequence term" line of the trace status display shows the number of the term 
the sequencer was in when the trace completed. Because a branch out of the last 
sequence term constitutes the trigger, the number displayed is what would be the 
next term (2 in the example below) even though that term is not defined. If the 
trace is halted, the sequence term number just before the halt is displayed; 
otherwise, the current sequence term number is displayed. If the current sequence 
term is changing too quickly to be read, a question mark (?) is displayed. 

The "Occurrence left" line of the trace status display shows the number of 
occurrences remaining before the primary branch can be taken out of the current 
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sequence term. If the occurrence left is changing too quickly to be read, a question 
mark (?) is displayed. 



Examples To display the trace status: 

U>ts 

Emulation Trace Status 

NEW User trace complete 

Arm ignored 

Trigger in memory 

Arm to trigger ? 

States 1024 (1024) 0. .1023 

Sequence term 2 

Occurrence left 1 



To halt a trace measurement 

• Enter the th command. 

The th (trace halt) command allows you to halt a trace measurement. When the th 
command is entered, the message "Emulation trace halted" is displayed. 



Examples To halt a trace measurement: 



U>th 

Emulation trace halted 
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Displaying Traces 

When states are stored in trace memory, you can display these states in the trace 
list. Also, you can change the format of the trace list. This section describes how 
to: 

• Display the trace list. 

• Change the format of the trace list. 



To display the trace 



• Use the tl command. 



The tl (trace list) command displays the trace data. 



Examples The trace list displayed in the following examples was set up with the following 

commands. 

U>rst 
R>t 

Emulation trace started 
R>r crtl: entry 
U>ts 

Emulation Trace Status 

NEW User trace complete 

Arm ignored 

Trigger in memory 

Arm to trigger ? 

States 1024 (1024) 0..1023 

Sequence term 2 

Occurrence left 1 
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To display the trace list: 
u>ti 

Line addr,H 8018x mnemonic, H count, R 

0 ffffO ffH, opcode fetch MON ********* 

1 819ca eaH, opcode fetch ROM ********* 

2 819ca JMP FAR PTR 819cfH ********* 

3 819cb OfH, opcode fetch ROM ********* 

4 819cc 00H, opcode fetch ROM ********* 

5 819cd 9cH, opcode fetch ROM ********* 

6 819ce 81H, opcode fetch ROM ********* 

7 819cf b8H, opcode fetch ROM ********* 

8 819cf b8H, opcode fetch ROM ********* 

9 819cf MOVAX,#1001H ********* 

The first column in the trace list contains the line number. The trigger is always on 
lineO. 

The second column contains the address information associated with the trace 
states. Addresses in this column may be locations of instruction opcodes on fetch 
cycles, or they may be sources or destinations of operand cycles. 

The third column shows mnemonic information about the emulation bus cycle. 

The next column shows the count information. The "R" indicates that each count is 
relative to the previous state. If the analyzer's maximum qualified clock speed is 
set to "fast" or if the count qualifier is turned off (the default), time counts cannot 
be displayed and this column will contain asterisks (*). 



The default number of states to display is 10. 
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To display the top 10 states with symbols and absolute addresses in the address 

column: 

u>ti -e -t 10 



Line 


addr, H 


8018x mnemonic, H 






count, R 


0 


f f f f 0 


ffH, opcode 


fetch 


MON 


********* 


1 


entry 


eaH, opcode 


fetch 


ROM 


********* 


2 


entry 


JMP FAR PTR 819cfH 






********* 


3 


819cb 


OfH, opcode 


fetch 


ROM 


********* 


4 


819cc 


00H, opcode 


fetch 


ROM 


********* 


5 


819cd 


9cH, opcode 


fetch 


ROM 




6 


819ce 


81H, opcode 


fetch 


ROM 




7 


819cf 


b8H, opcode 


fetch 


ROM 


********* 


8 


819cf 


b8H, opcode 


fetch 


ROM 


********* 


9 


819cf 


MOV AX, #1001H 






********* 



To display the states at line 170: 

U>tl 170 



Line 


addr, H 


8018x mnemonic, H 




count , R 


170 


8064e 


leH, opcode fetch 


ROM 




171 


1954c 


53H, mem read 




********* 


172 


1954d 


00H, mem read 




********* 


173 


1954e 


9cH, mem read 




********* 


174 


1954f 


81H, mem read 




********* 


175 


81al3 


b8H, opcode fetch 


ROM 


********* 


176 


81al3 


MOV AX, #125dH 




********* 


177 


81al4 


5dH, opcode fetch 


ROM 




178 


81al5 


12H, opcode fetch 


ROM 




179 


81al6 


50H, opcode fetch 


ROM 


********* 
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To change the trace display format 

• Use the tf command. 

You can change the format of the trace information with the tf (trace format) 
command. 

The tf command primarily allows you to arrange the columns of trace information 
in a different manner. However, you can include any trace label in the trace. Also, 
the trace label information can be displayed in various number bases, and counts 
can be displayed relative or absolute. 

You can include information about the sequencer in the trace by including the "seq" 
column in the trace format command. The "+" characters in this column identify 
states that trigger the analyzer or cause sequencer branches. 

If your analyzer card contains external analysis (for example, HP 64703), you can 
include external analysis data in the trace by including the "xbits" column in the 
trace format command. This column shows the data captured on the external trace 
signals. 



Examples To view the trace display format: 



u>tf 

tf addr,H mne count, R 



To change the trace format so that the address column is 14 characters wide and the 
sequence information is shown: 





U>tf 


addr , h, 14 mne 


count , r 


seq 








U>tl 


-e -t 










ie 


addr, H 


8018x mnemonic, H 






count, R 


0 


f f f f 0 


ffH 


opcode 


fetch 


MON 


********* 


1 


crtl : entry 


eaH 


opcode 


fetch 


ROM 


********* 


2 


crt 1 : entry 


JMP FAR PTR 


819cfH 






********* 


3 


819cb 


OfH 


opcode 


fetch 


ROM 




4 


819cc 


00H 


opcode 


fetch 


ROM 


********* 


5 


819cd 


9cH 


opcode 


fetch 


ROM 


********* 


6 


819ce 


81H 


opcode 


fetch 


ROM 


********* 


7 


819cf 


b8H 


opcode 


fetch 


ROM 


********* 


8 


819cf 


b8H 


opcode 


fetch 


ROM 


********* 



9 819cf MOV AX,#1001H 
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Qualifying Trigger and Store Conditions 

This section describes tasks relating to the qualification of trigger and storage states. 

You can trigger on, or store, specific states or specific values on a set of trace 
signals (which are identified by trace labels). 

Also, you can prestore states. The prestore qualifier is a second storage qualifier 
used for storing states that occur before the normally stored states. Prestore is 
useful for capturing entry points to procedures or for identifying where global 
variables are accessed from. 

This section describes how to: 

• Qualify the trigger state. 

• Trigger on a number of occurrences of some state. 

• Change the trigger position in the trace. 

• Qualify states stored in the trace. 

• Activate and qualify prestore states. 

• Change the count qualifier. 



Expressions in Trace Commands 

Expressions are used in commands which qualify the trace. Expressions may be 
specified in the following forms (the pound sign, #, appears before comments): 



any/all # special tokens 

never /none 

arm 



label=<value> 
label ! =<value> 

label=<value> and label=<value> . 
label ! =<value> or label ! =<value> 
label=<value> . .<value> 
label ! =<value> . . <value> 



# this condition 

# not this condition 

# this range 

# not this range 



Note that if you wish to specify an expression such as "label=<value> and 
label !=<value>", you must configure the analyzer so that you have access to its full 
capability (refer to the "Using the Emulation Analyzer - Complex Configuration" 
chapter). 
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Note also that only one range resource is available. You can, however, use this 
range (or "not this range") in more than one trace command. 

Tokens The tokens any or all specify any or all conditions; you can use these 
tokens interchangeably. The tokens never or none specify false conditions; they 
are used to turn off qualifiers. The never and none tokens may also be used 
interchangeably. The arm token represents a condition external to the analyzer. 
Arm conditions are described in the "Making Coordinated Measurements" chapter. 

Trace Labels Labels may be predefined trace labels or labels which you define 
with the tlb (trace label) command. Trace labels can be up to 31 characters long. 
When you define a trace label, you assign trace signals to the label name. The 
emulation analyzer trace signals are described in the table that follows. 
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Emulation Analyzer Trace Signals 


Trace 
Signals 


Signal 
Name 


Signal 
Description 


0-19 


A0-A19 


Address Lines 0-19. 


20-23 


Processor S0-S3 
(S3 bond-out 
emulation processor 
specific) 


101 1 = Halt acknowledge cycle. 

1000 = Interrupt acknowledge cycle. 

i r\r\ i t / a ~\ ill 

1001 = I/O port read cycle. 
1010 = I/O port write cycle. 
1 101 = Memory read cycle. 
1110 = Memory write cycle. 
1 100 = Opcode fetch. 


24 


Processor BHE 


0 = Bus High Enable. 


25 


Bus Grant 


0 = Bus granted between previous state and this one. 


26 


Processor S6 


0 = Processor cycle, 1 = DMA cycle. 


27 


Guarded Memory 


0 = Guarded memory access. 


28 


ROM Access 


0 = ROM access. 


29 


LOCK Asserted 


0 = LOCK asserted. 


30 


Monitor/User 


0 = Background, 1 = Foreground. 


31 


Execution/Bus Cycle 


0 = Executed instruction state, 1 = non-instruction states. 


32-47 


D0-D15 


Processor Data 0-15. (Signals 40-47 not used with 8-bit 
processors.) 



Predefined Trace Labels To see the trace labels which have been predefined, 

enter the tlb (trace label) command with no options. 

M>tib 

#### Emulation trace labels 
tlb addr 0 . . 19 
tlb data 32 . . 47 
tlb stat 20 . . 31 
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These predefined trace labels represent emulation processor signals as described 
below. 

addr Represents the trace signals (0 through 19) which monitor the 

emulation processor's address pins. 

data Represents the trace signals (32 through 47) which monitor the 

emulation processor's data pins. 

stat Represents the trace signals (20 through 31) which monitor 

other emulation processor signals. 

Values Values can be numeric constants (in several bases), symbols, or equates. 
Values can also be constants, symbols, and equates combined with operators. 
(Refer to the <value> description in the "Commands" chapter for information on 
constants and operators.) 

Predefined Equates The equ (specify equates) command allows you to equate 
values with names. Equates for common trace label values are predefined. To 
view the equates, enter the equ command with no options. (These status equates 
are also listed in the help proc information.) 



U>equ 










### 


Equates 


### 






equ 


bus = 


; 0 lxxxxxxxxxxxy 


# 


Bus cycle. 


equ 


coproc= 


; 0 lxxxxxxxxxxxy 


# 


Coprocessor cycle. 


equ 


dma = 


; 01xxxxlxxxxxxy 


# 


DMA cycle (for 80186/8/XL/EA/EC) 


equ 


grd= 


; 01xxx0xxxxxxxy 


# 


Guarded memory access. 


equ 


hlt= 


^OlxxxxxxxlOlly 


# 


Halt acknowledge cycle. 


equ 


instr= 


; 0 Oxxxxxxxxxxxy 


# 


Executed instruction state. 


equ 


inta= 


; 01xxxxxxxl000y 


# 


Interrupt acknowledge cycle. 


equ 


ior = 


; 01xxxxxxxl001y 


# 


I/O port read cycle. 


equ 


iow= 


; 01xxxxxxxl010y 


# 


I/O port write cycle. 


equ 


mon = 


; 0x0xxxxxxxxxxy 


# 


Monitor cycle. 


equ 


mr = 


^OlxxxxxxxllOly 


# 


Memory read cycle. 


equ 


mw= 


^OlxxxxxxxlllOy 


# 


Memory write cycle. 


equ 


of= 


; 01xxxxxxxll00y 


# 


Opcode fetch. 


equ 


proc = 


; 01xxxx0xxxxxxy 


# 


Processor (not DMA) cycle. 


equ 


rom= 


; 01xx0xxxxxxxxy 


# 


Access to ROM cycle. 


equ 


usr = 


; Oxlxxxxxxxxxxy 


# 


User (foreground) cycle. 
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These predefined equates may be used to specify values for the stat trace label 
when qualifying trace conditions. For example: 

stat=mw 

is the same as: 

stat=01xxxxxxxlll0y 

Equates, either predefined or user-defined, are translated to their actual values when 
used. Re-defining an equate will not affect commands in which the equate was 
previously used. For example, if you enter the commands equ count=100; tg any 
count; equ count=5, the occurrence count in the trigger specification is still 100. 
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To qualify the trigger state 

• Use the tg command. 

The tg (specify simple trigger) command allows you to specify when the analyzer 
should begin storing states. 



Examples Suppose you want to look at the execution of the demo program after the 

instructions at "main", and, therefore, you would like to begin storing states after 
address "main". To do this you could enter the commands shown below. 

U>tinit 

U>tg addr=main:_main 

U>t 

Emulation trace started 
U>r crtl: entry 
U>ts 

Emulation Trace Status 

NEW User trace complete 

Arm ignored 

Trigger in memory 

Arm to trigger ? 

States 1024 (1024) 0..1023 

Sequence term 2 

Occurrence left 1 
U>tf addr,h,14 mne count, r seq 
U>tl -e 



Line addr,H 8018x mnemonic, H count, R seq 



0 


main: _ma i n 


55H, 


opcode fetch 


ROM 


********* 


1 


main: main 


PUSH BP 






********* 


2 


80001 


8bH, 


opcode fetch 


ROM 


********* 


3 


80002 


ecH, 


opcode fetch 


ROM 




4 


19540 


00H, 


mem write 




********* 


5 


19541 


00H, 


mem write 




********* 


6 


80001 


MOV BP, SP 






********* 


7 


80003 


leH, 


opcode fetch 


ROM 


********* 


8 


80003 


PUSH DS 






********* 


9 


80004 


b8H, 


opcode fetch 


ROM 


********* 
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To trigger on a number of occurrences of some 
state 

• Use the tg <qualifier> <occurrence count> command. 

When specifying a simple trigger, you can include an occurrence count. The 
occurrence count specifies that the analyzer trigger on the Nth occurrence of some 
state. 

The default base for an occurrence count is decimal. You may specify occurrence 
counts from 1 to 65535. 



Examples To trigger on the 100th occurrence of the call to the "update_system" function: 

U>tg addr=update_sys :_update_system 100 

U>t 

Emulation trace started 
U>ts 

Emulation Trace Status 

NEW User trace complete 

Arm ignored 

Trigger in memory 

Arm to trigger ? 

States 1024 (1024) -1..1022 

Sequence term 2 

Occurrence left 1 
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To change trigger position in the trace 

• Use the tp command. 

The tp (trigger position) command changes the trigger position in the trace. 

The trigger position default is tp s, which specifies that the trigger appears at the 
start of the trace. You can also specify that the trigger appear in the center of the 
trace with the tp c command, or that the trigger appear at the end of the trace with 
the tp e command. 

Additionally, you can specify a certain number of states to appear before (tp -b 10) 
or after (tp -a 1014) the trigger in the trace. 

When the analyzer counts time or states, the actual trigger position is within +/- 1 
state of the number specified. When counts are turned OFF, the actual trigger 
position is within +/- 3 states of the number specified. 



Examples To place the trigger state in the center of the trace: 

u>tp c 

u>t 

Emulation trace started 
U>ts 

Emulation Trace Status 

NEW User trace complete 

Arm ignored 

Trigger in memory 

Arm to trigger ? 

States 1024 (1024) -513.. 510 

Sequence term 2 

Occurrence left 1 

Notice in the trace status information that states are stored before and after the 
trigger. 
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To qualify states stored in the trace 

• Use the tsto command. 

By default, all captured states are stored; however, you can qualify which states get 
stored with the tsto (trace storage qualifier) command. 



Examples To store only the states which write to the "target_temp" variable, enter the 

following commands. 

U>tsto addr=main:_target_temp and stat=mw 
U>tg any 
U>tp s 

U>t 

Emulation trace started 
U>tl 



Line addr,H 8018x mnemonic, H count, R seq 



0 19496 07H, mem read ********* + 

1 n :_target_temp 49H, mem write ********* 

2 n :_target_temp 48H, mem write ********* 

3 n :_target_temp 47H, mem write ********* 

4 n :_target_temp 46H, mem write ********* 

5 n :_target_temp 45H, mem write ********* 

6 n :_target_temp 44H, mem write ********* 

7 n :_target_temp 43H, mem write ********* 

8 n :_target_temp 42H, mem write ********* 

9 n :_target_temp 41H, mem write 



********* 



Notice that the trigger state (line 0) is included in the trace list; trigger states are 
always stored. 



To activate and qualify prestore states 

• Use the tpq <qualifier> command. 

Prestore allows you to save up to two states which precede a normal store state. 
Prestore is turned off by default. However, you can use the tpq command to 
specify a prestore qualifier. 
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Prestore is useful when you want to find the cause of a particular state. For 
example, if a variable is accessed from many different places in the program, you 
can qualify the trace so that only accesses of that variable are stored. Then, you can 
turn on prestore to find out where accesses of that variable originate from. 

States which satisfy the prestore qualifier and the storage qualifier at the same time 
are stored as normal states. 

The analyzer uses the same resource to save prestore states as it does to save count 
tags. Consequently, the "prestore" string is shown in the "count" column of the 
trace list. Notice that the time counts are relative to the previous normal storage 
state. Turning off the count qualifier does not turn off prestore: however, the 
"prestore" string cannot be seen in the "count" column of the trace list. 



Examples To prestore function entries (typically PUSH BP instructions whose opcode is 55H) 

on writes to the "target_temp" variable: 

U>tsto addr=main:_target_temp and stat=mw 
U>tpq data=0xx55 and stat=of 
U>tg any 

U>t 

Emulation trace started 
U>tl -e 



Line addr,H 8018x mnemonic, H count, R seq 

0 8049e INSTRUCTION — opcode unavailable ********* + 

1 _update_system 55H, opcode fetch ROM ********* 

2 s :_get_targets 55H, opcode fetch ROM ********* 

3 n :_target_temp 58H, mem write ********* 

4 _update_system 55H, opcode fetch ROM ********* 

5 s :_get_targets 55H, opcode fetch ROM ********* 

6 n :_target_temp 57H, mem write ********* 

7 _update_system 55H, opcode fetch ROM ********* 

8 s :_get_targets 55H, opcode fetch ROM ********* 

9 n :_target_temp 56H, mem write ********* 



Note that this does not prestore all function entries because only low byte reads of 
55H are captured. In the complex mode, you can set up the analyzer to capture 
either high or low byte reads of 55H. 

To turn off prestore states: 

U>tpq none 
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To change the count qualifier 

• To turn OFF counting, use the tcq none command. 

• To count states, use the tcq <qualifier> command. 

• To count time, use the tcq time command. 

After initializing the analyzer, the default count qualifier is none. When counting 
is turned OFF, up to 1024 states can be stored in the trace. 

When you count states, the counter is incremented each time the state is captured 
(not necessarily stored) by the analyzer. When a state is counted, up to 512 states 
can be stored in the trace. 

You can only count time if the processor clock speed is less than or equal to 
16 MHz. If this is the case, you must enter the tck -s S command before you can 
enter the tcq time command. When time is counted, up to 512 states can be stored 
in the trace. 



Examples Suppose you want to know how many loops of the program occur between calls of 

the "do_sort" function. You can use the tcq command to count a state that occurs 
once for each loop of the program. 

First, set up the analyzer so that only accesses of the "do_sort" address are stored: 

U>tsto addr=main:_do_sort and stat=instr 

Next, specify the count qualifier as a state that occurs once for each loop of the 
program, for example, the "update_system" function: 

U>tcq addr=update_sys :_update_system and stat=instr 
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Finally, set up to trigger on any state, start the trace, and display the trace: 

U>tg any 
U>t 

Emulation trace started 
U>tl -e 



Line 


addr, 


H 




8018x mnemonic, H 




count, R 


0 


80111 




INSTRUCTION- 


-opcode 


unavailable 




1 


main : 


_do_ 


.sort 


INSTRUCTION- 


-opcode 


unavailable 


4 


2 


main : 


_do_ 


.sort 


INSTRUCTION- 


-opcode 


unavailable 


4 


3 


main : 


_do_ 


.sort 


INSTRUCTION- 


-opcode 


unavailable 


4 


4 


main : 


_do_ 


.sort 


INSTRUCTION- 


-opcode 


unavailable 


4 


5 


main : 


do 


.sort 


INSTRUCTION- 


-opcode 


unavailable 


4 


6 


main : 


_do_ 


.sort 


INSTRUCTION- 


-opcode 


unavailable 


4 


7 


main : 


do 


.sort 


INSTRUCTION- 


-opcode 


unavailable 


4 


8 


main : 


do 


.sort 


INSTRUCTION- 


-opcode 


unavailable 


4 


9 


main : 


do 


.sort 


INSTRUCTION- 


-opcode 


unavailable 


4 



seq 



To turn counting OFF: 

U>tcq none 
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Using the Sequencer 

By using the sequencer, you can trigger after a sequence of states instead of just one 
state. The sequencer has several levels, called sequence terms. 

Each sequence term can search for two states at a time: a primary state and a 
secondary state. The primary state may have an occurrence count specified. If the 
primary state occurs the number of times specified, the sequencer branches to the 
next term. If the secondary state is found before the primary state occurs the 
number of times specified, the sequencer branches back to the first term. 

The same secondary branch condition is used for all sequence terms, and secondary 
branches are always back to the first term; therefore, the secondary branch is called 
the global restart. 

The last sequence term defines the trigger state. A branch out of this term 
constitutes the trigger. 

This section describes how to: 

• Reset the sequencer. 

• Display the sequencer specification. 

• Specify primary and secondary branch conditions. 

• Add or insert sequence terms. 

• Delete sequence terms. 

The Default Sequencer Specification 

After power-up, initialization, or sequencer reset, the sequencer consists of one 
term. 
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PRIMARY BRANCHES 

( TERM1 "V 

V / N tif 1 any 

{PRIMARY BRANCH ON ANY STATE) 
(TRIGGER = BRANCH OUT OF TERM1) 
tsto all 

(ALL CAPTURED STATES ARE STORED) 



It may be helpful to think of the tif (primary branch expression) command as a 
conditional statement. For example, "If (some state occurs), then branch". 

Because sequence term 1 is the last term and a branch out of the last term 
constitutes the trigger, the primary branch expression (any) of term 1 specifies the 
trigger condition. The expression any says that any captured trace state will cause 
a branch. Therefore, the trigger will occur immediately after the t (trace) command 
is issued (if instructions are being executed). 

The tsto (trace storage qualifier) command specifies that all captured states are 
stored. The trace storage qualifier is a global; that is, it applies to all sequence 
terms. In addition to states which satisfy the trace storage qualifier, any state which 
causes a branch is stored in trace memory. Also, prestore states can be saved before 
states which satisfy the trace storage qualifier. 

The telif command is used to specify the secondary branch expression for every 
sequence term; this expression is called the global restart. It may be helpful to 
think of the telif command as an "else if" conditional statement. For example, 
"Else if (some state occurs before) then branch to term 1". 

The global restart in the default sequencer specification is never. This means no 
trace state can cause a secondary branch. 



SECONDARY BRANCHES 

telil never 

(NO SECONDARY 

BRANCHES) 
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Simple Trigger and the Sequencer 

The simple trigger command used previously in this chapter has the following 
effect on the sequencer: 

U>tinit 

U>tg addr=update_sys :_update_system 

U>tsq 

tif 1 addr=update_sys :_update_system 
tsto all 
telif never 

Notice that only the primary branch expression of the first sequence term (the 
trigger condition) is different than the default sequencer specification. An address 
value equal to the symbol "update_sys:_update_system" will trigger the analyzer, 
causing trace memory to be filled with states and stop. 

When the tg command is entered with no options, the primary branch expression of 
the first sequence term is displayed. This is the trigger condition only when one 
term exists in the sequencer. 



To reset the sequencer 

• Enter the tsq -r command. 

To reset the sequencer to its default, power-up state use the -r option to the tsq 
(trace sequencer) command. 



Examples To reset the sequencer: 

U>tsq -r 
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To display the sequencer specification 

• Enter the tsq command with no options. 

To display the sequencer specification, enter the tsq command with no options. 



Examples u>tsq 

tif 1 any 
tsto all 
telif never 

The tif 1 any part of the sequencer specification says that any state will cause a 
branch out of term 1 . The tsto all says all states will be stored, and the telif never 
says that the global restart is turned off. 



To specify primary and secondary branch 
expressions 

• Use the tif and telif commands. 

The tif command lets you qualify the states searched for by sequence terms. 

The telif command lets you qualify the state that will cause a global restart 
(sequencer branch back to term 1). 



Examples You can use sequence terms to trace a specific combination of events. For 

example, the "do_sort" function may or may not be called after the "interrupt_sim" 
function. If you triggered on the sequence "interrupt_sim" followed by "do_sort", 
several loops of the program could be captured between the two events. Suppose 
you want to trace only the situation where "do_sort" is called right after 
"interrupt_sim" is called. 
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Set up the sequencer so that it first searches for the call to "interrupt_sim" as the 
primary branch expression of the first sequence term. 

U>tif 1 addr=main:_interrupt_sim and stat=instr 

After "interrupt_sim" is found, the sequencer should then search for the call to 
"do_sort". You can do this by specifying the address "do_sort" as the primary 
branch expression of the second sequence term. 

U>tif 2 addr=main:_do_sort and stat=instr 

However, if the program executes the RET instruction of the "interrupt_sim" 
function (address 800D8H) before the call to "do_sort", you know that "do_sort" 
was not called this time, and the sequencer should start over. You can specify the 
global restart expression to do this. 

U>telif addr=800d8 and stat=instr 

If the "do_sort" function is called before the program executes the RET instruction 
at 800D8H, the sequencer will take a primary branch out of the last term and trigger 
the analyzer. Set up the analyzer so that only sequencer branches are stored. 

U>tsto never 

The resulting sequencer specification is shown below. 

U>tsq 

tif 1 addr=main :_interrupt_sim and stat=instr 
tif 2 addr=main :_do_sort and stat=instr 
tsto never 

telif addr=800d8 and stat=instr 

The sequencer specification above is represented in the figure below. The primary 
branch expression of the first sequence term is the address of the "interrupt_sim" 
function. The primary branch expression for the second sequence term is the 
address of the "do_sort" function; it is also the trigger condition. The primary 
branch out of the second term constitutes the trigger. 
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SECONDARY BRANCHES 



PRIMARY BRANCHES 



( ELSE IF PROGRAM 
RETURNS FROM 
"interrupt_sim" 
FUNCTION BEFORE 
THE CALL TO 
do_sorl" OCCURS, 
THEN RESTART THE 
SEQUENCE. > 




TERM1 



TERM2 




( IF THE CALL TO "interrupLsim" 
OCCURS, BRANCH TO TERM2 ) 



( IR THE CALL TO "dD_sorl" 
OCCURS, THEN TRIGGER > 



( TRIGGER = BRANCH OUT OF TERM2 > 

( ONLY SEQUENCER BRANCHES ARE STORED > 

64767S06 



The sequencer works like this: After the trace is started, the first sequence term 
searches for the call to "interrupt_sim". When the call to "interrupt_sim" is found, 
the sequencer branches to term 2. Now, the second sequence term searches for the 
address "do_sort". If the address "do_sort" is found before the state which satisfies 
the secondary branch expression (the return at address 800D8H), the analyzer is 
triggered, causing the analyzer memory to be filled with states before the analyzer 
stops. If the RET instruction at address 800D8H is executed before the primary 
branch (in either the first or second terms), the sequencer branches back to the first 
sequence term. 

The following commands position the trigger state in the center of the trace, start 
the trace, and display the trace status. 

u>t 

Emulation trace started 
U>ts 

Emulation Trace Status 

NEW User trace running 
Arm ignored 
Trigger not in memory 
Arm to trigger ? 
States ? (8) ? . . ? 
Sequence term 3 
Occurrence left 1 

Notice, even though the trigger is not in memory, that 8 states have been stored. It 
is possible that the trigger is in the analyzer's two state pipeline, in which case, you 
must halt the trace in order to see the stored states. 
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U>th 

Emulation trace halted 

The "seq" column in the trace list contains information about the sequencer. A "+" 
in the "seq" column indicates the state satisfied a branch condition. To add the 
"seq" column to the trace list, enter the following command. 

U>tf addr,h,14 mne count, r seq 

Listing the trace will result in the following display. 
U>tl -e 



Line 


addr, H 


8018x mnemonic, H 




count, R 


seq 


-8 


800d8 


INSTRUCTION- 


-opcode 


unavailable 


********* 


+ 


-7 


_interrupt_sim 


INSTRUCTION- 


-opcode 


unavailable 


********* 


+ 


-6 


800d8 


INSTRUCTION- 


-opcode 


unavailable 


********* 


+ 


-5 


_interrupt_sim 


INSTRUCTION- 


-opcode 


unavailable 


********* 


+ 


-4 


800d8 


INSTRUCTION- 


-opcode 


unavailable 




+ 


-3 


_interrupt_sim 


INSTRUCTION- 


-opcode 


unavailable 


********* 


+ 


-2 


800d8 


INSTRUCTION- 


-opcode 


unavailable 


********* 


+ 


-1 


_interrupt_sim 


INSTRUCTION- 


-opcode 


unavailable 


********* 


+ 


0 
1 


ma i n : _do_s o rt 


INSTRUCTION- 


-opcode 


unavailable 


********* 


+ 



Remember, the primary branch out of the last term constitutes the trigger. 

Also, a primary branch always advances to the next higher term. A secondary 
branch from any term is always made back to the first sequence term (global 
restart). 
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To add or insert sequence terms 

• Use the tsq -i command. 

The sequencer may have a total of 4 terms. You can add or insert sequence terms 
with the tsq (trace sequencer) command using the -i (insert) option. If the term 
number specified already exists, the new sequence term is inserted before the 
existing term; otherwise, the new sequence term is added. 



Examples To insert a second sequence term: 

U>tsq 

tif 1 addr=main :_interrupt_sim and stat=instr 
tif 2 addr=main :_do_sort and stat=instr 
tsto never 

telif addr=800d8 and stat=instr 
U>tsq -i 2 
U>tsq 

tif 1 addr=main :_interrupt_sim and stat=instr 
tif 2 any 

tif 3 addr=main :_do_sort and stat=instr 
tsto never 

telif addr=800d8 and stat=instr 
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To delete sequence terms 



• Use the tsq -d command. 

You delete sequence terms using the -d option to the tsq (trace sequencer 
specification) command. 

After a term is deleted, the remaining terms are renumbered. 



Examples To delete the second sequence term: 

U>tsq 

tif 1 addr=main :_interrupt_sim and stat=instr 
tif 2 any 

tif 3 addr=main :_do_sort and stat=instr 
tsto never 

telif addr=800d8 and stat=instr 
U>tsq -d 2 
U>tsq 

tif 1 addr=main :_interrupt_sim and stat=instr 
tif 2 addr=main :_do_sort and stat=instr 
tsto never 

telif addr=800d8 and stat=instr 
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This chapter describes how to use the emulation analyzer in its "complex" 
configuration (the "Using the Emulation Analyzer - Easy Configuration" chapter 
describes how to use the emulation analyzer in its easy-to-use configuration). 

The basic differences between the easy configuration and the complex 
configuration are in the sequencer and the expressions used to qualify states. 
Therefore, this chapter describes the following tasks: 

• Switching into the complex configuration. 

• Using complex expressions. 



• Using the sequencer. 
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Switching into the Complex Configuration 

This section describes how to: 

• Switch into the complex configuration 

• Switch back into the easy configuration 



To switch into the complex analyzer configuration 

• Enter the tcf -c command. 

To enter the "complex" analyzer configuration, use the -c option to the tcf (trace 
configuration) command. This will cause the analyzer to be initialized to its default 
"complex" configuration state. 



To switch back into the easy analyzer 
configuration 

• Enter the tcf -e command. 

The tcf -e command will place the analyzer back into the "easy" configuration. 
Changing the analyzer configuration to "easy" will reset the trace pattern 
specifications, the trigger position, and the count and prestore qualifiers. 
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Using Complex Expressions 

In the "complex" configuration, up to eight pattern resources and one range 
resource may be used in trace commands wherever state qualifier expressions were 
used in the "easy" configuration. In fact, state qualifiers are assigned to the pattern 
and range resources. 

The additional capability allowed in the "complex" configuration is that these 
patterns may be used in combinations to specify more complex qualifiers. The 
pattern and range resources are divided into two sets, and you can combine 
resources with the set operators. 

This section describes how to: 

• Assign state qualifiers to trace patterns. 

• Assign state qualifiers to the trace range. 

• Combine pattern and range qualifiers. 



To assign state qualifiers to trace patterns 

• Use the tpat command. 

Up to eight trace patterns can be specified with the tpat (trace pattern) command. 
The trace pattern names are pi, p2, p8. 

The expression associated with a trace pattern can be the keywords all, any, none, 
or never, or the expression may be trace labels equated to values (which can be 
ANDed together) or trace labels not equal to values (which can be ORed together). 

Consider whether or not you will be using global set operators (and or or) with any 
of the patterns; if so, make sure those patterns are in different sets. 
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Examples To assign to pattern pi the state where the address value equals 520H, the data 

value equals 0XXAA1234H, and the status is a memory write: 

U>tpat pi addr=520 and data=0xxaal234 and stat=write 

To assign to pattern pi any state except where the address value equals 5C2H, the 
data value equals 0XX3X5678H, and the status is a memory write: 

U>tpat pi addr!=5c4 or data ! =0xx3x5678 or stat!=write 



To assign state qualifiers to the trace range 

• Use the trng command. 

One trace range can be specified with the trng (trace range) command. The range 
name is r, and !r specifies "not in range". 

The expression associated with a trace range can be the keywords all, any, none, or 
never, or the expression may be a trace label equated to a range of values. 



Examples To assign the address range 500H through 5FFH to the range resource: 

U>trng addr=500 . . 5f f 

To assign the data range 80H through 8FH to the range resource: 

U>trng data=0080 . . 008f 
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To combine pattern and range resources 

• Use the set operators. 

The eight patterns (pl..p8), the range (r for "in range" or !r for "not in range"), and 
the arm qualifier (described in the "Making Coordinated Measurements" chapter) 
are grouped into the two sets shown below. 

Set 1: pi, p2, p3, p4, r, and !r. 

Set 2: p5, p6, p7, p8, and arm. 

Resources within a set may be combined using one of the intraset operators, I (OR) 
or ~ (NOR). 

The two sets can be combined with the and and or interset (between set) operators. 
Interset operators are also called global set operators. 

The intraset (within a set) operators (~, I) are evaluated first; then, the interset 
operators are evaluated. You cannot use interset operators on patterns in the same 
set. 

Though only the OR (I) and NOR (~) logical operators are available as intraset 
operators, you can create the AND and NAND operators by applying DeMorgan's 
law (the "/" character is used to represent a logical NOT): 

AND A and B = /(/A and /B) NOR 

NAND / (A and B) = /A or /B OR 



Examples Some valid intraset combinations follow. 

U>tsto pi | p2 | p3 I r 
U>tsto p5 ~ p6 ~ arm 

The following expression is invalid because you cannot use both I (OR) and ~ 
(NOR) operators within the same set. 

U>tsto pi | p2 ~ p3 

! ERROR 1249! Invalid qualifier expression: ~ p3 
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The following expression is invalid because you cannot combine resources from 
different sets with the I (OR) or ~ (NOR) operators. 
u>tsto pi ~ p2 ~ p5 

! ERROR 1249! Invalid qualifier expression: p5 



Some valid combinations of the two sets follow. 

U>tsto pi ~ p2 and p5 | p6 
U>tsto p3 | p4 | !r or p7 
U>tsto p8 ~ arm and pi ~ p2 



The following set combination is invalid because pi and p2 are in the same set. 

U>tsto pi and p2 

! ERROR 1249! Invalid qualifier expression: p2 

Note that "pi ~ pi " is allowed; this type of expression may occasionally be useful 
if you are running out of pattern resources and wish to specify a logical NOT of 
some existing pattern. For example, consider the following commands: 

tpat pi addr=0 

tif 1 pi 

tif 2 pi ~ pi 

The primary branch of term 2 will be taken when "addr!=0". 

An example of using DeMorgan's law to create the AND operator follows. 

Suppose you want to specify the following storage qualifier: 

U>tsto pi & p2 or p5 & p6 

1ERR0R 1241! Invalid qualifier resource or operator: S 

The error occurs because the & operator is not a valid intraset operator. If the 
specifications for the trace patterns are: 

tpat pi addr=5f0 

tpat p2 data=3 9xxxxxx and stat=write 
tpat p5 addr=500 

tpat p6 data=0xx3 9xxxx and stat=write 

you can enter an equivalent expression to the one which caused the error by making 
the following changes to the trace patterns and using the NOR (~) operator in the 
tsto command. 

U>tpat pi addr!=5f0 

U>tpat p2 data ! =39xxxxxx or stat!=write 
U>tpat p5 addr!=500 

U>tpat p6 data ! =0xx39xxxx or stat!=write 
U>tsto pi ~ p2 or p5 ~ p6 



161 



Chapter 6: Using the Emulation Analyzer - Complex Configuration 
Using the Sequencer 



Using the Sequencer 

This section describes how to use the sequencer in the "complex" configuration. 
The differences between using the sequencer in the "easy" configuration and in the 
"complex" configuration are summarized in the following table. 



Differences Between the "Easy" and "Complex" Analyzer Configurations 


Analyzer Feature 


In the "easy" configuration . . . 


In the "complex" configuration . . . 


sequence terms 
and the trigger 
(tsq) 


You can insert or delete terms from the 
sequencer, and the branch out of the last 
sequence term constitutes the trigger. 


There are always eight terms in the 
sequencer. Any of the sequence terms 
except the first may be specified as the 
trigger term. Entry into the trigger term 
constitutes the trigger. 


simple trigger 
(tg) 


The simple trigger command (tg) sets up 
a one term sequencer, and the expression 
specified with the tg command becomes 
the primary branch expression of the first 
sequence term. 


The simple trigger command (tg) sets the 
primary branch expression of sequence 
term 1 , and specifies the second 
sequence term as the trigger term. 


primary branch 

expressions 

(tif) 


Primary branches are always made to the 
next higher sequence term. 


Primary branches may be made to any 
sequence term. 


secondary branch 

expressions 

(telif) 


The secondary branch expression is a 
global restart. In other words, the 
secondary branch expression applies to 
all sequence terms, and the branch is 
always back to the first sequence term. 


Secondary branch expressions may be 
specified for each sequence term. Also, 
secondary branches can be made to any 
sequence term. 


storage qualifiers 
(tsto) 


The trace storage qualifier is "global" 
and applies to all sequence terms. 


A storage qualifier is associated with 
each sequence term; however, the tsto 
command still allows you to specify 
storage qualifiers globally. 
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In the complex configuration, you perform the same tasks as are performed in the 
easy configuration. However, in the complex configuration, you have more 
sequence terms, you can specify destination terms for primary and secondary 
branches, and you can specify storage qualifiers for each sequence term. 

This section describes how to: 

• Reset the sequencer. 

• Specify a simple trigger condition. 

• Specify primary and secondary branches. 

• Specify the trigger term. 

• Specify storage qualifiers. 

• Trace windows of execution. 



To reset the sequencer 

• Enter the tsq -r command. 

After entering the "complex" analyzer configuration, the sequencer is in its default 
reset state. 

If the analyzer is already in the "complex" configuration, you can reset the 
sequencer to its default state with the tsq -r command. 



Examples To reset the sequencer: 

U>tsq -r 

To display the default sequencer specification: 

U>tsq 

tif 1 any 2 
tif 2 any 3 
tif 3 any 4 
tif 4 any 5 
tif 5 any 6 
tif 6 any 7 
tif 7 any 8 
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tif 

tsq 

tsto 

tsto 

tsto 

tsto 

tsto 

tsto 

tsto 

tsto 

teli 

teli 

teli 

teli 

teli 

teli 

teli 

teli 



never 
2 

all 
all 
all 
all 
all 
all 
all 
all 
never 
never 
never 
never 
never 

6 never 

7 never 

8 never 



There are eight terms in the "complex" configuration sequencer. By default, the 
primary branch expression for each term (except term 8) is any, the secondary 
branch expression for each term is never, and the storage qualifier for each term is 
all. The trigger term is the second sequence term. This sequencer specification 
will result in the same trace data as the default sequencer specification in the "easy" 
configuration (except that there will be more sequencer branches after the trigger). 
A diagram of the default sequencer specification is shown in the figure below. 



SECONDARY BRANCHES 
ielif 1 never 

ielif 2 never 
ielif 3 never 
ielif 4 never 



ielif 5 never 



ielif 6 never 



ielif 7 never 



ielif 8 never 



c 



TERM1 



c 
c 
c 
c 
c 
c 
c 



TERM2 



TERM3 



TERM4 



TERMS 



TERM6 



TERM7 



TERMS 



PRIMARY BRANCHES 
tsto 1 oil 

iif 1 ony 2 

tsq -t 2 (TRIGGER TERM) 
tsto 2 oil 

iif 2 ony 3 

isto 3 oil 

iif 3 ony 4 

isto 4 oil 

iif 4 ony 5 

isto 5 oil 

tif 5 ony 6 

isto 6 oil 

tif 6 ony 7 

iato 7 oil 

tif 7 ony 8 

isto 8 oil 
(ALL STATES STORED) 
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If the tsq information scrolls off your screen, you may wish to display the 
sequencer specifications with a combination of other display commands; for 
example, you could enter the tif, telif, tsto, and tsq -t commands to display the 
same information. 



To specify a simple trigger condition 

• Use the tg command. 

Using the tg (simple trigger) command in the "complex" configuration will cause 
the first two sequence terms to be modified. The pattern specified in the tg 
command becomes the primary branch expression of the first sequence term. The 
primary and secondary branch expressions of the second sequence term are set to 
never, and this term is specified as the trigger term. The secondary branch 
expression of the first sequencer term is also set to never. 

The result of the tg command in the "complex" configuration is the same as in the 
"easy" configuration, and equivalent tg commands (where the pattern is the same as 
the "easy" configuration expression, and the storage qualifiers are the same) will 
yield identical traces in each of the trace configurations. 

As in the "easy" configuration, the tg command with no options will display the 
primary branch expression of the first sequence term. This will only be the trigger 
condition when the second sequence term is the trigger term. 



Examples To set up a simple trigger on the address "update_sys:_update_system": 

U>tpat pi addr=update_sys :_update_system 
U>tg pi 
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U>tsq 

tif 1 pi 2 
tif 2 never 
tif 3 any 4 
tif 4 any 5 
tif 5 any 6 
tif 6 any 7 
tif 7 any 8 
tif 8 never 
tsq -t 2 
tsto 1 all 
tsto 2 all 
tsto 3 all 
tsto 4 all 
tsto 5 all 
tsto 6 all 
tsto 7 all 
tsto 8 all 
telif 1 never 
telif 2 never 
telif 3 never 
telif 4 never 
telif 5 never 
telif 6 never 
telif 7 never 
telif 8 never 



A diagram of this sequencer specification is shown in the figure below. 



SECONDARY BRANCHES 



PRIMARY BRANCHES 



telif 1 never 



c 



TERN1 



3 




lit 1 p1 2 



CALL TO "updQte_sys1em 



FUNCTION 



telif 2 never 



c 



TERM2 




1sq -t 2 (TRIGGER TERM) 



lit 2 never 



(REMAINING SEQUENCE TERMS ARE NOT 



SHOWN SINCE NO BRANCHES ARE MADE TO THEM.) 
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To specify primary and secondary branch 
expressions 

• Use the tif and telif commands. 

In the "easy" configuration, primary branches are always to the next sequence term. 
In the "complex" configuration, primary branches may be to any sequence term. 
Therefore, the number of the destination term must be specified before the 
occurrence count. 

In the "easy" configuration, the secondary branch expression is a "global restart". It 
applies to all sequence terms and causes branches back to the first sequence term. 
In the "complex" configuration, you can specify secondary branch expressions for 
each sequence term and the branch may be to any sequence term. Therefore, the 
number of the destination term must be specified. 



Examples To specify a primary branch from sequence term 2 to sequence term 5 when the 

pattern p2 is found: 
u>tif 2 p2 5 

To specify a secondary branch from sequence term 2 to sequence term 3 when the 
pattern p3 is found: 

U>telif 2 p3 3 

To specify that the sequencer never branch out of term 5: 

U>tif 5 never 
U>telif 5 never 
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To specify the trigger term 

• Use the tsq -t command. 

In the "easy" configuration, the branch out of the last sequence term constitutes the 
trigger. In the "complex" configuration there are always eight terms in the 
sequencer, and any of the sequence terms except the first may be specified as the 
trigger term. Entry into the trigger term constitutes the trigger. The trigger term is 
specified with the tsq -t command. 



Examples To specify that entry into the fifth term constitutes the trigger: 

U>tsq -t 5 



To specify storage qualifiers 

• Use the tsto command. 

In the "easy" configuration, the trace storage qualifier is global, that is, it applies to 
all sequence terms. In the "complex" configuration, storage qualifiers are 
associated with each sequence term (though you can specify that one storage 
qualifier applies to all terms). 

Prestore qualifiers still apply to all normal storage states; however, in the 
"complex" configuration, you specify pattern or range resources with the tpq 
command. 



Examples To store states matching pattern p4 while searching for the branch expressions of 

sequence term 7: 

U>tsto 7 p4 
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To store states matching the range resource while searching for the branch 
expressions of sequence term 5: 

U>tsto 5 r 

To store all states when searching for branch expressions, except when searching 
for the branch expressions of sequence term 1 : 
u>tsto all 

U>tsto 1 none 



To trace windows of activity 

1 Set up one sequence term as the window enable term. 

2 Set up one sequence term as the window disable term. 

3 Set up a trigger term. 

4 Do not store states while searching for the window enable condition. 

5 Store all states while searching for the window disable condition. 

One common use for the "complex" configuration sequencer is to trace "windows" 
of execution or, perhaps, to eliminate "windows" of execution from traces. 

For example, suppose you wish to trace only the execution within a certain range of 
addresses. These addresses could be a subroutine or perhaps they are just the 
addresses of instructions in which you are interested. 

A simple windowing sequencer specification would consist of a window enable 
term, a window disable term, and perhaps a trigger term (if you wish to trigger on a 
condition other than the enable or disable terms). Only the states which occur 
between the window enable condition and the window disable condition are stored. 
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To trace only the demo program execution from the call of the "update_system" 
function to the call of the "get_targets" function, you would set up the sequencer 
specification so that the call to the "update_system" function is the window enable 
term and the return at the call to the "get_targets" function is the window disable 
term. 

Suppose also that you wish to trigger on any state in the window of execution. The 
diagram of the sequencer to do this is shown in the figure below. 



window enable 



trigger state 



window disable 
state 

window enable 
state 




To reset the sequencer: 

U>tsq -r 

To specify trace patterns: 

U>tpat pi addr=update_sys :_update_system and stat=instr 
U>tpat p2 addr=update_sys :_get_targets and stat=instr 
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To specify the primary and secondary branch expressions: 

u>tif l pi 2 
U>tif 2 any 3 
U>telif 2 p2 1 
U>tif 3 p2 4 
U>tif 4 pi 3 



To specify the trigger term: 
U>tsq -t 3 

To specify the storage qualifiers so that states are stored only while searching for 
the window disable condition (the first command below specifies all storage 
qualifiers to be none, and the second command specifies that all states be stored 
while searching for the window disable condition): 

U>tsto none 
U>tsto 2 all 
U>tsto 3 all 



To place the trigger position at the center of the trace: 

U>tp c 



To display the sequencer specification. 

U>tsq 

tif 1 pi 2 
tif 2 any 3 
tif 3 p2 4 
tif 4 pi 3 
tif 5 any 6 
tif 6 any 7 
tif 7 any 8 
tif 8 never 
tsq -t 3 
tsto 1 none 
tsto 2 all 
tsto 3 all 
tsto 4 none 
tsto 5 none 
tsto 6 none 
tsto 7 none 
tsto 8 none 
telif 1 never 
telif 2 p2 1 
telif 3 never 
telif 4 never 
telif 5 never 
telif 6 never 
telif 7 never 
telif 8 never 
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Starting the trace, waiting for the measurement to complete, and displaying the 
trace will result in the following information. 

u>t 

Emulation trace started 
U>ts 

Emulation Trace Status 

NEW User trace complete 

Arm ignored 

Trigger in memory 

Arm to trigger ? 

States 512 (512) -1 . .510 

Sequence term 4 

Occurrence left 1 
U>tf addr,h,14 mne count, r seq 
U>tl -et 80 



ne 


addr, H 


8018 


x mnemonic, H 






count , R 


-1 


update system 


INSTRUCTION 


— opcode 


unavailable 




********* 


0 


815ad 




8bH 


opcode 


fetch 


ROM 


********* 


1 


815ae 




ecH 


opcode 


fetch 


ROM 


********* 


2 


19538 




f OH 


mem write 




********* 


3 


19539 




7eH 


mem write 




********* 


4 


815ad 


MOV 


BP, SP 








********* 


5 


815af 




leH 


opcode 


fetch 


ROM 


********* 


6 


815af 


PUS1 


DS 








********* 


7 


815b0 




b8H 


opcode 


fetch 


ROM 


********* 


8 


815bl 




09H 


opcode 


fetch 


ROM 


********* 


9 


19536 




09H 


mem write 




********* 


10 


19537 




10H 


mem write 






11 


815b0 


MOV 


AX, #100 


3H 






********* 


12 


815b2 




10H 


opcode 


fetch 


ROM 




13 


815b3 




8eH 


opcode 


fetch 


ROM 


********* 


14 


815b3 


MOV 


DS,AX 








********* 


15 


815b4 




d8H 


opcode 


fetch 


ROM 


********* 


16 


815b5 




baH 


opcode 


fetch 


ROM 


********* 


17 


815b5 


MOV 


DX, #100 


3H 






********* 


18 


815b6 




09H 


opcode 


fetch 


ROM 


********* 


19 


815b7 




10H 


opcode 


fetch 


ROM 




20 


815b8 




90H 


opcode 


fetch 


ROM 


********* 


21 


815b8 


NOP 










********* 


22 


815b9 




b8H 


opcode 


fetch 


ROM 


********* 


23 


815b9 


MOV 


AX, #018eH 






********* 


24 


815ba 




8eH 


opcode 


fetch 


ROM 


********* 


25 


815bb 




01H 


opcode 


fetch 


ROM 


********* 


26 


815bc 




90H 


opcode 


fetch 


ROM 


********* 


27 


815bc 


NOP 










********* 


28 


815bd 




52H 


opcode 


fetch 


ROM 




29 


815bd 


PUS! 


DX 








********* 


30 


815be 




50H 


opcode 


fetch 


ROM 




31 


815bf 




baH 


opcode 


fetch 


ROM 


********* 


32 


19534 




09H 


mem write 




********* 


33 


19535 




10H 


mem write 




********* 


34 


815be 


PUS! 


AX 








********* 


35 


815c0 




09H 


opcode 


fetch 


ROM 


********* 


36 


19532 




8eH 


mem write 




********* 


37 


19533 




01H 


mem write 




********* 
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O O 


Q "I CUf 

O 1 ODI 




MOV 


DX, #1009H 






7V7V7V7V7V7V7V7V7V 


1 Q 
o y 


ol jCI 








10H, 


opcode 


fetch 


ROM 




a n 
^ u 


8 1 5 c2 








90H, 


opcode 


fetch 


ROM 


7V7V7V7V7V7V7V7V7V 


4 1 


8 1 5 c2 




NOP 












********* 


4 2 










b8H, 


opcode 


fetch 


ROM 


7V7V7V7V7V7V7V7V7V 


43 


8 1 5c3 




MOV 


AX, 


#018cH 






7V7V7V7V7V7V7V7V7V 


4 4 


Ol J04 








8cH, 


opcode 


fetch 


ROM 


********* 


^ o 


Ol c„c 
Ol JtJ 








01H, 


opcode 


fetch 


ROM 




4 6 


8 1 5c 6 








90H, 


opcode 


fetch 


ROM 


********* 


4 7 


8 1 5c 6 




NOP 












********* 


/l S3 


Ol jC / 








52H, 


opcode 


fetch 


ROM 


********* 


Zl Q 


8 1 5 c 7 




PITCH 


DX 










7V7V7V7V7V7V7V7V7V 


o u 


8 1 5 c 8 








50H, 


opcode 


fetch 


ROM 


********* 


^ i 


OljC.7 








9aH, 


opcode 


fetch 


ROM 


7V7V7V7V7V7V7V7V7V 


52 


19530 








09H, 


mem write 




7V7V7V7V7V7V7V7V7V 


53 


19531 








10H, 


mem write 




********* 


54 


815c8 




PUSH 


AX 










********* 


5 5 


815ca 








8cH, 


opcode 


fetch 


ROM 


********* 


3 0 


1 9 5 2 e 








8cH, 


mem write 




********* 


3 / 


1 9 5 2 f 








01H, 


mem write 




********* 


58 


815c9 




CALL 


FAR PTR 


update. 


_sys :_get_ 


_targ 


********* 


3 :? 


815 cb 








00H, 


opcode 


fetch 


ROM 


********* 


60 


815cc 








5aH, 


opcode 


fetch 


ROM 


********* 


61 


815cd 








81H, 


opcode 


fetch 


ROM 


********* 


£9 
DZ 


o -L 3 O e 








83H, 


opcode 


fetch 


ROM 


********* 


63 


1952c 








5aH, 


mem write 






64 


1952d 








81H, 


mem write 






65 


1952a 








2eH, 


mem write 






66 


1952b 








00H, 


mem write 




********* 


67 
68 


s :_get_ 
s :_get_ 


targets 
targets 


PUSH 


BP 


55H, 


opcode 


fetch 


ROM 


********* 
********* 


69 


_update 


_system 


INSTRUCTION-- 


-opcode 


unavailable 


********* 


70 


815ad 








8bH, 


opcode 


fetch 


ROM 


********* 


71 


815ae 








ecH, 


opcode 


fetch 


ROM 


********* 


72 


19538 








f OH, 


mem write 






73 


19539 








7eH, 


mem write 






74 


815ad 




MOV 


BP, 


SP 








********* 


75 


815af 








leH, 


opcode 


fetch 


ROM 




76 


815af 




PUSH 


DS 










********* 


77 


815b0 








b8H, 


opcode 


fetch 


ROM 


********* 


78 


815bl 








09H, 


opcode 


fetch 


ROM 


********* 
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Using the External State Analyzer 



The HP 64703A analyzer provides 16 external trace signals (in addition to the 64 
channels of emulation analysis). These trace lines allow you to analyze additional 
target system signals. The external analyzer may be configured as an extension to 
the emulation analyzer, as an independent state analyzer, or as an independent 
timing analyzer. 

Note that the external analyzer's independent timing mode (xtmo -t) cannot be 
used from the Terminal Interface. A host computer interface is necessary to 
provide timing analysis. Consequently, independent timing analysis is not 
described in this manual. Refer to the appropriate host computer interface manual 
(either the 80186/8/XL/EA/EB/EC Emulator User's Guide for the PC Interface or 
the 80186/8/XL/EA/EB/EC Emulator User's Guide for the Graphical User 
Interface). 

The tasks you perform with the external analyzer are grouped into the following 
sections: 

• Setting up the external analyzer. 

• Using the external analyzer as part of the emulation analyzer. 

• Using the external analyzer as an independent state analyzer. 
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Setting Up the External Analyzer 

This section assumes you have already connected the external analyzer probe to the 
HP 64700 Card Cage as described in Step 1, panel 13 of the "Installation" chapter. 

Before you can use the external analyzer, you must: 

• Connect the external analyzer probe to the target system. 

• Specify threshold voltages of external trace signals. 

• Label the external trace signals. 

• Select the external analyzer mode. 
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To connect the external analyzer probe to the 
target system 



1 Assemble the Analyzer Probe. The analyzer probe is a two-piece assembly, consisting of ribbon cable 
and 18 probe wires (16 data channels and the J and K clock inputs) attached to a connector. Either end of 
the ribbon cable may be connected to the 18 wire connector, and the connectors are keyed so they may 
only be attached one way. Align the key of the ribbon cable connector with the slot in the 18 wire 
connector, and firmly press the connectors together. 
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2 Attach grabbers to probe wires. Each of the 18 probe wires has a signal and a ground connection. 
Each probe wire is labeled for easy identification. Thirty-six grabbers are provided for the signal and 
ground connections of each of the 18 probe wires. The signal and ground connections are attached to the 
pin in the grabber handle. 
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CAUTION Turn OFF target system power before connecting analyzer probe wires to the target 

system. The probe grabbers are difficult to handle with precision, and it is 
extremely easy to short the pins of a chip (or other connectors which are close 
together) with the probe wire while trying to connect it. 



3 You can connect the grabbers to pins, connectors, wires, etc., in the target system. Pull the hilt of the 
grabber towards the back of the grabber handle to uncover the wire hook. When the wire hook is around 
the desired pin or connector, release the hilt to allow the grabber spring tension to hold the connection. 
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To specify threshold voltages 

• Use the xtv command. 

The external analyzer probe signals are divided into two groups: the lower byte 
(channels 0 through 7 and the J clock), and the upper byte (channels 8 through 15 
and the K clock). You can specify a threshold voltage for each of these groups. 

The default threshold voltages are specified with the keyword TTL which 
translates to 1.4 volts. 

Use the xtv (threshold voltage for external trace signals) command to specify 
different threshold voltages. The -1 option to xtv allows you to specify threshold 
voltages for the lower group. The -u option allows you to specify threshold 
voltages for the upper group. 

Voltages may be in the range from -6.4 volts to 6.35 volts (with a 50 mV 
resolution); you may also use the keywords TTL, CMOS (which translates to 2.5 
volts), or ECL (which translates to -1.3 volts). 



Examples To specify CMOS threshold voltages for all external trace signals: 

U>xtv -1 CMOS -u CMOS 



181 



Chapter 7: Using the External State Analyzer 
Setting Up the External Analyzer 



To define external trace labels 

• Use the xtlb command. 

You may wish to define external trace labels to make specifying qualifiers easier. 
External trace labels may be used in any of the external analyzer modes. 

One external trace label has been predefined, xbits. This label is associated with all 
16 external trace signals. This label appears in the default trace format and listing. 

If you wish to define external trace labels to further break down the external 
signals, use the xtlb (external trace label) command. 

You may change the trace listing format (xtf or tf) to include external labels in the 
trace after they have been defined. 



Examples To define an external analyzer label, iodata, for external analyzer signals 0 through 

7: 

U>xtlb iodata 0 . . 7 
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Using with the Emulation Bus Analyzer 

By default, on power-up or after trace initialization (tinit), the external analyzer is 
aligned with the emulator. In this mode, you have 16 external trace signals which 
are clocked with the same clock signal as the emulation bus analyzer. The external 
trace signals may be used to capture target system signals synchronized with the 
emulation clock. 

When the external analyzer operates as an extension of the emulation analyzer, they 
operate as one analyzer. The only external trace commands allowed in this mode 
are xtv, xtlb, and xtmo. You can, however, display the help text for the other 
external trace commands. The external labels may be referenced in emulation trace 
commands in this mode. 

External trace signal data is captured on the trace clock specified in the tck (trace 
clock source) command. You should not use the external J and K signals to clock 
the emulation trace; however, you may wish to use these signals to qualify the 
emulation trace clock (refer to the "Qualifying the Analyzer Clock" section of the 
"Using the Analyzer — Easy Configuration" chapter.) 



To select the "emulation analyzer extension" 
mode 

• Enter the xtmo -e command. 

To re-select the emulation analyzer extension mode, use the xtmo -e command. 
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Using as an Independent State Analyzer 

The external analyzer may also operate as an independent state analyzer. The 
independent state analyzer is identical to the emulation analyzer, except that only 
16 bits of analysis are available. The analyzer now acts as two separate state 
analyzers; two sets of analyzer resources (trace memory, patterns, qualifiers, etc.) 
are available, one for the emulation analyzer and one for the independent state 
analyzer. 

When the independent state analyzer mode is selected, you can use one analyzer to 
arm the other. You can specify the arm condition as a qualifier, perhaps as the 
trigger condition (cross-triggering). (Refer to the "Making Coordinated 
Measurements" chapter for more information on cross-triggering.) 

This section describes how to: 

• Select the independent state external analyzer mode. 

• Specify the external analyzer clock. 

• Specify the maximum qualified clock speed. 

• Qualify the external analyzer clock. 

• Use slave clocks for mixed clock demultiplexing. 

• Use slave clocks for true demultiplexing. 

• Arm the external analyzer with the emulation analyzer trigger. 



To select the "independent state" mode 

• Enter the xtmo -s command. 

When you use the external analyzer as an independent state analyzer, a whole new 
set of external trace commands become available. Trace commands (except for the 
trace activity, ta, and trace initialization, tinit, commands) are duplicated for the 
independent state analyzer and prefixed with an x. 



184 



Chapter 7: Using the External State Analyzer 
Using as an Independent State Analyzer 

The following commands become available in the independent state mode: xt, 
xtarm, xtcf, xtck, xtcq, xtelif, xtg, xth, xtif, xtl, xtlb, xtp, xtpat, xtpq, xtrng, xts, 
xtsck, xtsq, and xtsto. These commands operate identically to their counterpart 
emulation analyzer commands. 



To specify the external analyzer clock source 

• Use the xtck -r <clock>, xtck -f <clock>, or xtck -x <clock> commands. 

The independent state analyzer is typically clocked with target system clock signals 
connected to the J and K external clock inputs. 

The independent state analyzer may also be clocked with the L, M, and N clock 
signals generated by the emulator. The L clock is the emulation clock derived by 
the emulator, the N clock is used as a qualifier to provide the user/background 
tracing options (-u and -b) to tck, and the M clock is not used. 

Once a clock signal has been selected, you must specify whether the analyzer is to 
clock on the rising edge of the signal, the falling edge, or both the rising and falling 
edges. The edge is specified by the three following xtck options. 

-r Specifies that the clock should take place on the rising edge of 

the signal(s) which follow. 

-f Specifies that the clock should take place on the falling edge of 

the signal(s) which follow. 

-x Specifies that the clock should take place on both edges of the 

signal(s) which follow. 

When several clocks are specified, they are ORed; that is, each signal specified will 
clock the analyzer. 



Examples To specify that the external analyzer be clocked on the rising edge of the JCL 

signal: 

U>xtck -r J 
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To specify that the external analyzer be clocked on the falling edge of the KCL 
signal: 

U>xtck -f K 

To specify that the external analyzer be clocked on both the rising and falling edges 
of the JCL signal: 

U>xtck -x J 



To specify the maximum qualified clock speed 

• Use the xtck -s S, xtck -s F, or xtck -s VF commands. 

The maximum qualified clock rate is the repetition rate of all specified clock 
signals (see the following figure). You are allowed to select the maximum 
qualified clock speed of the analyzer; however, there are tradeoffs involving the 
trace count qualifier to be considered: 

• Slow (xtck -s S). Slow specifies a maximum qualified clock rate of 16 MHz. 
When S is selected, there are no restrictions on the trace count qualifier. 

• Fast (xtck -s F). Fast specifies a maximum qualified clock rate of 20 MHz. 
When "F" is selected, the trace count qualifier may be used to count states but 
not time. 

• Very Fast (xtck -s VF). Very fast specifies a maximum qualified clock rate of 
25 MHz. When "VF" is selected, the trace count qualifier may not be used at 
all (in other words, xtcq none). 
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Examples 
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To qualify clocks 

• Use the xtck -h <clock> or xtck -1 <clock> commands. 

Independent state analyzer clock signals may be qualified with other clock signals; 
that is, the selected signals may only clock the analyzer when the qualifying clock 
signal is true. Clock signals are qualified by using the -1 and -h options to the xtck 
command. 

The -1 option is used to specify a qualifying signal which only allows the trace to 
clock when this signal is lower than the threshold voltage. 

The -h option is used to specify a qualifying signal which only allows the trace to 
clock when this signal is higher than the threshold voltage. 

Any signal, J, K, L, M, or N, may be used to qualify other signals. 

Note that if several clock qualifiers are specified, the analyzer will be clocked if 
any one is true. 

Qualifier setup time is approximately 25 nanoseconds when the external analyzer is 
aligned with emulation analyzer (xtmo -e). Qualifier setup time is approximately 
20 nanoseconds when the external analyzer operates as an independent state 
analyzer (xtmo -s). Qualifier hold time is approximately 5 nanoseconds. 



Examples To allow the external analyzer to be clocked when the signal on KCL is high: 

U>xtck -h K 
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To use slave clocks for mixed clock 
demultiplexing 

• Use the xtsck -m command. 

External analyzer slave clocks are specified with the xtsck (external trace slave 
clock) command. (Master clocks are specified by the xtck commands.) By default, 
the slave clocks are turned OFF, as may be specified by the -o option to the xtsck 
command. 

Rising edges (-r), falling edges (-f), or both edges (-x) of clocks J, K, L, M, or N 
may be specified as the slave clock. 

The mixed clock mode is specified with the -m option to the xtsck command. In 
this mode, the lower 8 channels of the pod (bits 0-7) are latched with the slave 
clock, and the master clock gates the entire pod (see the figure below). 
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If no slave clock has appeared since the last master clock, the data on the lower 8 
bits of the pod will be latched at the same time as the upper 8 bits. If more than one 
slave clock has appeared since the last master clock, only the first slave data will be 
available to the analyzer (see the figure below). 



MASTER r 
CLOCK 1 



SLAVE 
CLOCK 




FIRST SLAVE CLOCK CLOCKS IGNORED 

AFTER LAST MASTER 

CLOCK 



Examples To specify a slave clock on the rising edge of the KCL signal for mixed clock 

demultiplexing: 

U>xtsck -m -r K 



To use slave clocks for true demultiplexing 

• Use the xtsck -d command. 

External analyzer slave clocks are specified with the xtsck (external trace slave 
clock) command. (Master clocks are specified by the xtck commands.) By default, 
the slave clocks are turned OFF, as may be specified by the -o option to the xtsck 
command. 

Rising edges (-r), falling edges (-f), or both edges (-x) of clocks J, K, L, M, or N 
may be specified as the slave clock. 

The true demultiplexing mode is specified with the -d option to the xtsck 
command. In this mode, the lower 8 channels of the pod (bits 0-7) are latched with 
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the slave clock; the upper 8 channels also get data from signals 0-7, but they are 
clocked with the master clock. Thus, the analyzer gets two copies of bits 0-7. The 
slave clock latches the data for bits 0-7, and the master clock then gates the entire 
pod into the analyzer (see the figure below). 
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If no slave clock has appeared since the last master clock, the data on the lower 8 
bits of the pod will be the same as the upper 8 bits. If more than one slave clock 
has appeared since the last master clock, only the first slave data will be available to 
the analyzer. 



Chapter 7: Using the External State Analyzer 
Using as an Independent State Analyzer 



Examples To specify a slave clock on the rising edge of the KCL signal for true 

demultiplexing: 

U>xtsck -d -r K 



To arm the analyzer with the emulation analyzer 
trigger 

• Use the xtarm command. 

You can arm (that is, activate) the external analyzer when the emulation analyzer 
finds its trigger condition. The connection between the emulation analyzer and the 
external analyzer is made over one of the emulator's internal trigger signals (trigl 
or trig2). You set up the emulation analyzer to drive the internal trigger signal 
when it finds its trigger condition, and you use the xtarm command to arm the 
external analyzer when the internal trigger signal appears. 



Examples To arm the external analyzer with the emulation analyzer's trigger output over the 

internal trig2 signal: 

M>xtarm =trig2 
M>xtg arm 
M>xt 

External trace started 
M>tg any 
M>tgout trig2 
M>r rst 
U>t 

Emulation trace started 
U>xts 

Emulation Trace Status 

NEW User trace complete 
Arm received 
Trigger in memory 
States 512 (512) 0 . .512 
Sequence term 2 
Occurrence left 1 
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When HP 64700 Card Cages are connected together via the Coordinated 
Measurement Bus (CMB), you can start and stop up to 32 emulators at the same 
time. 

You can use the analyzer in one HP 64700 to arm (that is, activate) the analyzers in 
other HP 64700 Card Cages or to cause emulator execution in other HP 64700 Card 
Cages to break into the monitor. 

You can use the HP 64700' s BNC connector (labeled TRIGGER IN/OUT on the 
lower left corner of the HP 64700 rear panel) to trigger an external instrument (for 
example, a logic analyzer or oscilloscope) when the analyzer finds its trigger 
condition. Also, you can allow an external instrument to arm the analyzer or break 
emulator execution into the monitor. 

The coordinated measurement tasks you can perform are grouped into the 
following sections: 

• Setting up for coordinated measurements. 

• Starting and stopping multiple emulators. 

• Using external trigger signals. 



The location of the CMB and BNC connectors on the HP 64700 rear panel is 
shown in the following figure. 



CMB Connector 



BNC Connector 
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Signal Lines on the CMB 

There are three bi-directional signal lines on the CMB connector on the rear panel 
of the emulator. These CMB signals are: 

TRIGGER The CMB TRIGGER line is low true. This signal can be driven or 
received by any HP 64700 connected to the CMB. This signal can be used to 
trigger an analyzer. It can be used as a break source for the emulator. 

READY The CMB READY line is high true. It is an open collector and performs 
an ANDing of the ready state of enabled emulators on the CMB. Each emulator on 
the CMB releases this line when it is ready to run. This line goes true when all 
enabled emulators are ready to run, providing for a synchronized start. 

When CMB is enabled, each emulator is required to break to background when 
CMB READY goes false, and will wait for CMB READY to go true before 
returning to the run state. When an enabled emulator breaks, it will drive the CMB 
READY false and will hold it false until it is ready to resume running. When an 
emulator is reset, it also drives CMB READY false. 
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EXECUTE The CMB EXECUTE line is low true. Any HP 64700 on the CMB 
can drive this line. It serves as a global interrupt and is processed by both the 
emulator and the analyzer. This signal causes an emulator to run from a specified 
address when CMB READY returns true. 

BNC Trigger Signal 

The BNC trigger signal is a positive rising edge TTL level signal. The BNC trigger 
line can be used to either drive or receive an analyzer trigger, or receive a break 
request for the emulator. 

Comparison Between CMB and BNC Triggers The CMB trigger and BNC 
trigger lines have the same logical purpose: to provide a means for connecting the 
internal trigger signals (trigl and trig2) to external instruments. The CMB and 
BNC trigger lines are bi-directional. Either signal may be used directly as a break 
condition. 

The CMB trigger is level-sensitive, while the BNC trigger is edge-sensitive. The 
CMB trigger line puts out a true pulse following receipt of EXECUTE, despite the 
commands used to configure it. This pulse is internally ignored. 

Note that if you use the EXECUTE function, the CMB TRIGGER should not be 
used to trigger external instruments, because a false trigger will be generated when 
EXECUTE is activated. 
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Setting Up for Coordinated Measurements 

This section describes how to: 

• Connect the Coordinated Measurement Bus. 

• Connect the rear panel BNC. 



To connect the Coordinated Measurement Bus 
(CMB) 



CAUTION Be careful not to confuse the 9-pin connector used for CMB with those used by 

some computer systems for RS-232C communications. Applying RS-232C signals 
to the CMB connector is likely to result in damage to the HP 64700 Card Cage. 



To use the CMB, you will need one CMB cable for the first two emulators and one additional cable for 
every emulator after the first two. The CMB cable is orderable from HP under product number 
HP 64023 A. The cable is four meters long. 

You can build your own compatible CMB cables using standard 9-pin D type subminiature connectors 
and 26 AWG wire. 

Note that Hewlett-Packard does not ensure proper CMB operation if you are using a self -built cable! 
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Number of HP 64700 Series 
Flmiilatfirs 


Maximum Total Length of 
Cable 


Restrictions on the CMB 

V wllllV V L 1 \ / 1 1 


2 to 8 


100 meters 


None. 


9 to 16 


50 meters 


None. 


9 to 16 


100 meters 


Only 8 emulators may have rear 
panel pullups connected. * 


17 to 32 


50 meters 


Only 16 emulators may have rear 
panel pullups connected. * 


* A modification must be performed by your HP Customer Engineer. 
Emulators using the CMB must use background emulation monitors. 

At least 3/4 of the HP 64700-Series emulators connected to the CMB must be powered up before proper 
operation of the entire CMB configuration can be assured. 



To connect to the rear panel BNC 



CAUTION The BNC line on the HP 64700 accepts input and output of TTL levels only. (TTL 

levels should not be less than 0 volts or greater than 5 volts.) Failure to observe 
these specifications may result in damage to the HP 64700 Card Cage. 
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1 Connect one end of a 50 ohm coaxial cable with male BNC connectors to the HP 64700 BNC 
receptacle and the other end to the appropriate BNC receptacle on the other measuring instrument. 




SIDES OF JACK 



PUSH TOGETHER 
AND TORN UNTIL 
CONNECTORS LOCK 




The BNC connector is capable of driving TTL level signals into a 50 ohm load. (A positive rising edge is 
the trigger signal.) It requires a driver that can supply at least 4 mA at 2 volts when used as a receiver. 
The BNC connector is configured as an open-emitter structure which allows for multiple drivers to be 
connected. It can be used for cross-triggering between multiple HP 64700Bs when no other 
cross-measurements are needed. The output of the BNC connector is short-circuit protected and is 
protected from TTL level signals when the emulator is powered down. 
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Starting/Stopping Multiple Emulators 

When HP 64700 Card Cages are connected together via the Coordinated 
Measurement Bus (CMB), you can start and stop up to 32 emulators at the same 
time. These are called synchronous measurements. This section describes how to: 

• Enable synchronous measurements. 

• Start synchronous measurements. 

• Disable synchronous measurements. 



To enable synchronous measurements 

• Enter the cmb -e command. 

You can enable the emulator' s interaction with the CMB by using the cmb -e 
command. When the EXECUTE signal is received, the emulator will run at the 
address specified by the rx command. (Specifying an address with the rx 
command will automatically enable interaction with the CMB.) 

The tx -e command enables the analyzer to start a measurement when the 
EXECUTE signal is received. If trace at execute is disabled (tx -d), the analyzer 
ignores the CMB EXECUTE signal. 

Note that the cmb command does not affect the operation of analyzer 
cross-triggering. 



Examples To enable synchronous measurements with the cmb -e command: 

U>cmb -e 

To enable synchronous measurements with the rx <address> command: 

U>rx 920 
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To start synchronous measurements 

• Enter the x command. 

The x command causes the EXECUTE line to be pulsed, thereby initiating a 
synchronous measurement. CMB interaction does not have to be enabled (cmb -e) 
in order to use the x command. (The cmb -e command only specifies how the 
emulator will react to the CMB EXECUTE signal.) 

All emulators whose CMB interaction is enabled will break into the monitor when 
any one of those emulators breaks into its monitor. 

Note that when the CMB is being actively controlled by another emulator, the step 
command (s) does not work correctly. The emulator may end up running in user 
code (NOT stepping). Disable CMB interaction (cmb -d) while stepping the 
processor. 

U>x 



To disable synchronous measurements 

• Enter the cmb -d command. 

You can disable the emulator's interaction with the CMB by using the cmb -d 
command. When interaction is disabled, the emulator ignores the CMB EXECUTE 
and READY lines. 
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Using External Trigger Signals 

External trigger signals come from the CMB and BNC connectors. A diagram of 
the internal signals and the commands which may be used to drive them or to arm 
an analyzer with them are shown in the figure below. This diagram is only 
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intended to show logical connections, and does not represent actual circuitry inside 
the emulator. 

This section describes how to: 

• Arm analyzers with external trigger signals. 

• Break emulator execution with external trigger signals. 

• Send analyzers' trigger output signals to external lines. 



To arm analyzers with external trigger signals 

1 Use the cmbt -d or bnct -d commands to have the rear panel drive an internal 
trigger signal. 

2 Use the tarm or xtarm commands to arm the analyzer on the internal signal. 

By default, the analyzers are always armed. This means that the analyzers arm 
conditions are always true. 

The tarm (trace arm condition) command is used to specify or display the 
emulation analyzer arm condition. 

The xtarm (external trace arm condition) command is used to specify or display the 
independent state analyzer arm condition. 

There are two internal signals, trigl and trig2, which may be specified as the arm 
condition. You can specify that the arm condition be true when one of these two 
signals is true (=trigl or =trig2). 

By using !=trigl or !=trig2, you can specify that the analyzer be armed or never 
armed, depending on the state of the internal signal when the trace is started. . 

The keyword arm may be used to specify primary and secondary branch qualifiers, 
as well as storage or prestore qualifiers. 

It is often important to start the analyzer which receives a signal before the analyzer 
which drives the signal. For example, if you start the analyzer which drives a 
signal first, the signal may already be driven before you start the analyzer which 
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receives the signal. The receiving analyzer will most likely capture states which 
execute long after the condition which caused the signal to be driven. 



Examples To arm the emulation analyzer when the external CMB trigger signal is true: 

M>cmbt -d trigl 
M>tarm =trigl 

If you enter the following commands: 

M>bnct -d trig2 
M>tarm !=trig2 

If the trig2 signal is asserted when the analyzer is started, the analyzer can never be 
armed. If the trig2 signal is not asserted when the analyzer is started, the analyzer 
is armed immediately. 



To break emulator execution with external trigger 
signals 

• Use the be -e cmbt or be -e bnct commands. 

You can use the be -e cmbt or be -e bnct commands to enable emulator execution 
to break into the monitor when a trigger signal is received. 



Examples To enable breaks on the CMB TRIGGER signal: 

R>bc -e cmbt 

To enable breaks on the BNC TRIGGER signal: 

R>bc -e bnct 
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To send analyzer trigger output signals to 
external lines 

1 Use the cmbt -r or bnct -r commands to have the rear panel receive an internal 
trigger signal. 

2 Use the tgout or xtgout commands to drive the trigger output to the internal signal. 

The default condition of the analyzer specifies that neither the emulation analyzer 
nor the external analyzer will drive the internal trigl or trig2 signals when the 
trigger is found. 

The tgout command is used to specify that one of the internal signals be driven 
when the emulation analyzer trigger is found. 

The xtgout command is used to specify that one of the internal signals be driven 
when the independent state analyzer trigger is found. 

The tgout or xtgout commands with no options will display the signal which is 
currently being driven when the trigger is found (or none if no signal is driven 
when the trigger is found). 

The signals which may be driven when the trigger is found are the internal signals 
trigl and trig2. The trigl and trig2 signals may drive the CMB or BNC TRIGGER 
lines or the emulator break. 

Note that you should not set up an analyzer to both drive and receive the same 
trigger signal. For example, if you issue the commands tg arm; tarm =trigl; 
tgout trigl; bnct -d trigl -r trigl, the analyzer trigl signal will become latched in 
a feedback loop and will remain latched until the loop is broken. To break the loop, 
you must first disable the signal' s source, then momentarily disable either the drive 
or receive function. In this case, the commands tgout none and bnct -d none will 
break the loop. 



Examples To send the emulation analyzer trigger output to the CMB trigger line over the 

internal trigl signal: 

M>cmbt -r trigl 
M>tgout trigl 
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To send the independent state analyzer trigger output to the BNC trigger line over 
the internal trig2 signal: 

M>bnct -r trig2 
M>xtgout trig2 
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Reference 

Descriptions of the product in a dictionary or encyclopedia format. 
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This chapter describes: 

• The Terminal Interface commands. 

• Analyzer state qualifier expressions. 

• Values that that can be specified in commands. 
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<addr> - address specification in the 80186/188 
emulators 



xxxxx 

XXXX : XXXX 
XXXXX . . XXXXX 

XXXX : XXXX . . XXXX : XXXX 

XXXXX . . 
XXXX : XXXX . . 



20 bit physical address 

16:16 bit segment : of f set address 

address range, 20 bit address through 20 bit 

address 

address range, segment : of f set address through 
segment : of f set address 
128 byte address range 
128 byte address range 



You cannot mix physical and segmentioffset addresses when specifying address 
ranges. 
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b - break emulation processor to monitor 

b 

The b command issues a break to the emulator, causing it to stop executing the user 
program and begin execution of the monitor program. If the emulator is in the reset 
state when a break occurs, it will be released from reset and will begin execution 
within the emulation monitor. 

See Also r (runs the user program from the current pc or a specified address) 

s (steps the user program a number of instructions from the current pc or a specified 
address) 
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be - set or display break conditions 

be - display current setting for all break conditions 

be -e <condition> - enable specified break condition (s) 

be -d <condition> - disable specified break condition (s) 

be -d <condition> <condition> - multiple <condition>s allowed 



The be command allows you to set break conditions for the emulation system. This 
allows you to have the emulator break to the monitor upon error conditions (such as 
write to ROM), emulation processor trace events, or break to the monitor when a 
trigger signal is received. 

The parameters are as follows: 

-e Enables the indicated break conditions (which must be specified immediately 

following the -e on the command line). 

-d Disables the indicated break conditions (which must be specified immediately 

following the -d on the command line). 

<COndition> You can enable or disable the following break conditions: 



bp Software breakpoints and breakpoint registers. Software 

breakpoints and the processor breakpoint registers can not be 
configured independently. The "bp" condition enables or 
disables them both. 

rom Writes to ROM memory locations, as characterized when 

mapping memory. 

bnct Assertion of the rear panel BNC TRIGGER signal. Note that 

this signal may also drive either of the internal trigl or trig2 
signals or both. 

cmbt Assertion of the CMB (Coordinated Measurement Bus) 

TRIGGER signal. Note that the CMB trigger signal may also 
drive either of the internal trigl or trig2 signals or both. 

trigl Assertion of the internal trigl signal. Refer to the tgout, bnct, 

and cmbt commands for information on specifying drivers and 
receivers of the trigl signal. 
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trig2 Assertion of the internal trig2 signal. Refer to the tgout, bnct, 

and cmbt commands for information on specifying drivers and 
receivers of the trig2 signal. 

When you use the be command, the emulator may break into the monitor while 
each enable/disable is being executed. If the emulator was executing your program 
when the be command was received, it will return to your program when finished 
executing the command. If you request only a display of the current break 
conditions, the emulator does not break to the monitor. 

When a hardware reset occurs during processing of the be command, the result may 
be that a particular break condition is left in an unknown state. If this occurs, a 
display of the break conditions will show a question mark "?" instead of -e or -d 
next to the break condition. 

Since the 80186/188 emulator prefetches instructions, it is possible that an 
additional instruction may execute after the one which originally caused the break 
condition. If this does occur, the additional instruction was already in the 
processor's instruction pipeline; the emulator has no way of aborting the execution 
of that instruction. 

See Also bnct (specify drivers and receivers of the rear panel BNC signal) 

cmbt (specify drivers and receivers of the CMB trigger signal) 
bp (set/delete software breakpoints) 

map (specify whether memory locations are mapped as RAM or ROM) 

tgout (specify whether the trigl and/or trig2 signals are to be driven when the 
analyzer finds the trigger condition) 
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bnct - specify control of rear panel BNC signal 

bnct - display current bnct set up 

bnct -d <dtype> - rear panel BNC drives trig (1,2) signal (s) 

bnct -r <rtype> - rear panel BNC receives trig(l,2) signal (s) 

NOTES 

All option combinations are accepted: 

'bnct -d trigl,trig2 -r trigl,trig2' is a valid command 

The bnct command allows you to specify which of the internal trigl or trig2 
trigger signals will drive and/or receive the rear panel BNC trigger. You can 
specify the signals individually, as an ORed condition for drive, or as an ANDed 
condition for receive; or, you can specify that the signals are not to be driven or 
received. 

Upon powerup, bnct is set to bnct -d none -r none. 

The parameters are as follows: 

-d Specifies that the rear panel BNC port drives the internal trigger signals, trigl and 

trig2. 

-r Specifies that the rear panel BNC port receive the internal trigger signals, trigl or 

trig2, and send them out the BNC port. 

<dtype> The valid drive options are: 

trigl When the BNC signal is received, drive trigl signal. 

trig2 When the BNC signal is received, drive trig2 signal. 

none When the BNC signal is received, drive neither signal. 

<rtype> The valid receive options are: 

trigl When trigl signal goes true, send out the BNC signal. 

trig2 When trig2 signal goes true, send out the BNC signal. 

none Neither trigl or trig2 will send the BNC signal out. 

Normally, you would use this command to cross-trigger instruments. For example, 
you may wish to trigger a digitizing oscilloscope hooked to various timing signals 
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when the emulation analyzer finds a certain state, or, you may wish to do the 
converse and trigger the HP 64700' s analyzer when an oscilloscope finds its trigger. 

See Also be (break conditions; can be used to specify that the emulator will break into the 

emulation monitor upon receipt of one of the trigl/trig2 signals) 

cmbt (coordinated measurement bus trigger; used to specify which internal signals 
will be driven or received by the HP 64700 coordinated measurement bus) 

tarm (analyzer trace arm; used to specify arming (begin to search for trigger) 
conditions for the analyzer -- trigl/trig2 can be used to arm the analyzer) 

tgout (specifies which of the trigl/trig2 signals are to be driven when the analyzer 
trigger is found) 
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bp - set, enable, disable, remove or display 
software breakpoints 

bp - display current breakpoints 

bp -v - verbosely display current breakpoints 

bp <addr> - set breakpoint at <addr> 

bp -e * - enable all breakpoints 

bp -e <addr> - enable breakpoint at <addr> 

bp -d * - disable all breakpoints 

bp -d <addr> - disable breakpoint at <addr> 

bp -r * - remove all breakpoints 

bp -r <addr> - remove breakpoint at <addr> 

bp -p <addr> - set permanent breakpoint at <addr> 

bp -t <addr> <count> - set temporary breakpoint at <addr> 

with occurrence <count> (default 1) 
bp <addr> <addr> - more than one <addr> may be given 



<addr> 



<count> 



-d 



-P 



Upon powerup or init initialization, the breakpoint table is cleared and the 
breakpoint feature is disabled. 

The parameters are as follows: 

Specifies the address location where the software breakpoint is to be inserted. If 
you specify options -e, -d, or -r, the address specifies the location of the software 
breakpoint to be enabled, disabled, or removed. 

Specifies the number of times a temporary breakpoint can be hit before it becomes 
disabled. 

Enables (activates) the breakpoint(s) at the address(es) specified. This installs the 
necessary breakpoint instruction in memory. If the breakpoint is already enabled, 
no action is taken. 

Disables (deactivates) the software breakpoint(s) at the address(es) specified. 
When the software breakpoint is disabled, the original memory contents are 
restored if the breakpoint was enabled. The software breakpoint address(es) remain 
in the breakpoint definition table and can be reset by using the bp -e <ADDRESS> 
command. 

Sets a permanent breakpoint. Breakpoints set using this option remain active until 
disabled by bp -d or be -d bp commands. 

Removes the software breakpoint(s) at the addresses specified. When the software 
breakpoint is removed, the original memory contents are restored if the breakpoint 
was enabled; then, the address is removed from the breakpoint table. 
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-t 



Sets a temporary breakpoint. 



-V 



Displays the breakpoint list with -p, -t, and <count> parameters. 



Note that when the breakpoint table is displayed with the bp command, the 
enable/disable status of each breakpoint is tested by reading the memory locations 
in question. If a software break instruction is found, the breakpoint is displayed as 
"enabled"; if not, the breakpoint is displayed as "disabled". If the software 
breakpoint is in target RAM and emulator is running under the real-time restriction, 
the breakpoint is displayed as "status unknown". 

If the emulator executes an INT 3 instruction that was placed by you (either 
through your compiler or via memory modification) and not by the bp command, 
an "undefined breakpoint" error message is generated. 

If the emulator is executing in the user program when you define or modify 
breakpoints, it will break into the monitor for each breakpoint that is defined or 
modified. The emulator will return to user program execution after breakpoint 
definition or modification. 

Remember that any operation which modifies memory or the memory map will 
alter the existing breakpoints. For example, if you load a new program in the same 
address range where breakpoints reside, the breakpoints will be destroyed. 
Changing the memory map will prevent the emulator from placing new breakpoints 
or enabling existing breakpoints. 

The breakpoint break condition is enabled (be -e bp) after power-up or 
initialization. If you disable the breakpoints break condition with the be -d bp 
command, the software breakpoints currently defined will remain in the breakpoint 
table, but will be disabled and will remain in that state until the breakpoint feature 
is reenabled and the specified breakpoints are reenabled (be -e bp and bp -e 
<addr>). 



mo (defines memory access and display modes; the bp command uses the currendy 
defined modes when writing software breakpoints into memory) 



See Also 



be (enable/disable breakpoint conditions (including bp)) 
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cf - display or set emulation configuration 

cf - display current settings for all config items 

cf <item> - display current setting for specified <item> 

cf <item>=<value> - set new <value> for specified <item> 
cf <item> <item>=<value> <item> - set and display can be combined 



The parameters are as follows: 
<item> Configuration item. The valid 80186/188 emulator configuration items are: 

proc Set processor type. For the HP 64767 A: 

The cf proc=186EA command causes the emulator to 
emulate the 80C186EA processor. 

The cf proc=188EA command causes the emulator to 
emulate 80C188EA processor. 

The cf proc=186XL command causes the emulator to 
emulate 80C186XL, 80C186, and 80186 processors. 

The cf proc=188XL command causes the emulator to 
emulate 80C188XL, 80C188, and 80188 processors. 

For the HP 64767B: 

The cf proc=186EB command causes the emulator to 
emulate the 80C186EB processor. 

The cf proc=188EB command causes the emulator to 
emulate 80C188EB processor. 

For the HP 64767C: 

The cf proc=186EC command causes the emulator to 
emulate the 80C186EB processor. 

The cf proc=188EC command causes the emulator to 
emulate 80C188EC processor. 



221 



Chapter 9: Commands 

cf - display or set emulation configuration 



mon Select monitor option (bg, fg, ufg). 

The cf mon=bg command selects the default background 
monitor. 

The cf mon=fg command selects the default foreground 
monitor. 

The cf mon=ufg command selects a user supplied foreground 
monitor. Allows use of a foreground monitor that has been 
tailored to a specific target system. User code must first be 
loaded using the -f option of the load command. 

Note that all map terms are deleted when the monitor option is 
changed. Also, the single step vector must be loaded when 
using a foreground monitor. 

loc Foreground monitor location (any 4K boundary) and locking to 

target rdy. 

The cf loc=<address> command sets the foreground monitor 
base address and specifies that foreground monitor bus cycles 
are not locked to the target rdy line (no wait states). 

The cf loc=<address>,nolock command sets the foreground 
monitor base address and specifies that foreground monitor bus 
cycles are not locked to the target rdy line (no wait states). 

The cf loc=<address>,lock command sets the foreground 
monitor base address and specifies that foreground monitor bus 
cycles be locked to the target rdy line. 

rrt Restrict to real time (en or dis). This option can be used to 

prevent accidental breaks that might cause target system 
problems. 

When cf rrt=en and the emulator is running user code, the 
system refuses all commands that cause a break except rst, r, 
and b. (For example, register and memory commands that must 
access user memory). 
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When cf rrt=dis, the system will accept commands normally. 

rad Physical run address default (maxseg or minseg). When a 

physical address (non-segmented) is entered with either a run or 
step command, the emulator must convert it to a logical (dword) 
address. This option allows you to set the default algorithm for 
doing this. 

The cf rad=maxseg command specifies that the segment part of 
the resulting dword will be made as large as possible. 

The cf rad=minseg command specifies that the segment part of 
the resulting dword will be made as small as possible. 

For example, address 12345H is converted to 1234:0005H 
when cf rad=maxseg and to 1000:2345H when cf rad=minseg. 

If neither of these options is suitable, the run address may be 
entered explicitly in logical (dword) format (segmentioffset). 



See Also help (you can get an on line display of the configuration items for a particular 

emulator by typing help cf. To obtain more information regarding a particular 
configuration item, type help cf <config_item>). 
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cim - copy image of target memory into 
emulation memory 

cim <addr> . . <addr> - copy image in specified address 

range 

cim <addr> . . <addr> <addr> . . <addr> - copy multiple ranges 

The cim command allows you to copy an image of target memory into emulation 
memory. Typically, you use this command in order to be able to use the features 
associated with emulation memory (for example, software breakpoints, coverage 
memory, or the memory tag mode). 

Before you use the cim command, you must map emulation memory ranges 
corresponding to the target memory ranges you wish to copy. 

The parameters are as follows: 

<addr> Specifies the lower, and possibly upper, memory address boundaries of the target 

memory range to be copied. The default is a hexadecimal number; other bases may 
be specified. You can use "<addr>.." to specify a range from the address through 
the next 127 bytes. 

See Also map (used to define the type and location of memory used by the emulator) 
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cl - set or display command line editing mode 

cl - display command line edit mode 

cl -e - enable command line editing 

cl -d - disable command line editing 

cl -1 <columns> - number of columns for command line 



The cl command allows you to enable or disable command line editing. Command 
line editing has two typing modes. The normal command entry is input mode. The 
input mode functions like normal (canonical) command entry. The control mode 
allows command modification. 



The parameters are as follows: 
-e Enables command line editing, 

-d Disables command line editing. 

-I <COlumns> This option allows you to set the column length for the command line. The 

<columns> value can be from 40 to 132 columns. 
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The editing mode commands are as follows. 



Command 


Description 


<ESC> 


enter command editing mode 


i 


insert before current character 


a 


insert after current character 


X 


delete current character 


r 


replace current character 


dd 


delete command line 


D 


delete to end of line 


A 


append to end of line 


$ 


move cursor to end of line 


0 


move cursor to start of line 


A 


move cursor to start of line 


h 


move left one character 


1 


move right one character 


k 


fetch previous command 


j 


fetch next command 


/<string> 


find previous command in history matching <string> 


n 


fetch previous command matching <string> 


N 


fetch next command matching <string> 
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-d 



See Also 



cmb - enable/disable Coordinated Measurement 
Bus run/break 

cmb - display current setting 

cmb -e - enable CMB run/break interaction 

cmb -d - disable CMB run/break interaction 

The cmb command allows you to enable or disable interaction on the CMB 
(Coordinated Measurement Bus). The CMB allows you to make measurements 
involving cross-triggering of multiple HP 64700 analyzers, and to synchronously 
run and break multiple emulators. 

The cmb command only affects the ability for multiple emulators to run or break in 
a synchronized fashion. The analyzer trigger capability is unaffected by the cmb 
command. 

If no options are supplied, the current state of CMB enable/disable is displayed. 
The parameters are as follows: 

Enables interaction between the emulator and the Coordinated Measurement Bus. 

Disables interaction between the emulator and the Coordinated Measurement Bus. 

When interaction is enabled via the cmb -e command, the emulator will run code 
beginning at the address specified via the rx command when the CMB /EXECUTE 
(/ means active low) pulse is received. 

The CMB READY line is driven false while the emulator is running in the monitor. 
The line goes to the true state whenever execution switches to the user program. 

Notice that if the rx command is given, CMB interaction is enabled just as if a cmb 
-e command was issued. Refer to the syntax pages for the rx command for further 
information. 

When interaction is disabled via the cmb -d command, the emulator ignores the 
actions of the /EXECUTE and READY lines. In addition, the emulator does not 
drive the READY line. 



rx (allows you to specify the starting address for user program execution when the 
CMB /EXECUTE line is asserted) 
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tx (controls whether or not the emulation analyzer is started when the /EXECUTE 
line is asserted) 

x (pulses the /EXECUTE line, initiating a synchronous execution among emulators 
connected to the CMB and enabled) 

Also, refer to the "Making Coordinated Measurements" for further information on 
CMB operation. 
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cmbt - specify control of the rear panel CMB 
trigger signal 

cmbt - display current cmbt set up 

cmbt -d <dtype> - rear panel CMB drives trig (1,2) signal (s) 

cmbt -r <rtype> - rear panel CMB receives trig (1,2) signal (s) 

NOTES 

All option combinations are accepted: 

'cmbt -d trigl,trig2 -r trigl,trig2' is a valid command 



The cmbt command allows you to specify which of the internal trigl/trig2 trigger 
signals will drive and/or receive the rear panel CMB (Coordinated Measurement 
Bus) trigger. You can specify the signals individually, as an ORed condition for 
drive, or as an ANDed condition for receive; or, you can specify that the signals are 
not to be driven and/or received. 

If no options are specified, the current setting of cmbt is displayed. Upon powerup, 
cmbt is set to cmbt -d none -r none. 

The parameters are as follows: 

-d Specifies that the rear panel CMB TRIGGER line drives the internal trigger signals, 

trigl and trig2. 

-r Specifies that the rear panel CMB receive the internal trigger signals, trigl or trig2, 

and send them out on the CMB TRIGGER line. 

<dtype> The valid drive options are: 

trigl When the CMB TRIGGER signal is received, drive trigl signal. 

trig2 When the CMB TRIGGER signal is received, drive trig2 signal. 

none When the CMB TRIGGER signal is received, drive neither 

signal. 

<rtype> The valid receive options are: 

trigl When trigl signal goes true, send out the CMB TRIGGER 

signal. 
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trig2 When trig2 signal goes true, send out the CMB TRIGGER 

signal. 

none Neither trigl or trig2 will send the CMB TRIGGER signal out. 

You use this command to trigger other HP 64700 analyzers. For example, you may 
wish to start a trace on another HP 64700 analyzer when the analyzer in this 
emulator finds its trigger; or, you may wish to do the converse and trigger the 
analyzer in this emulator when another emulation analyzer finds its trigger. 

See Also be (break conditions; can be used to specify that the emulator will break into the 

emulation monitor upon receipt of one of the trigl/trig2 signals) 

bnct (BNC trigger; used to specify which internal signals will be driven or received 
by the rear panel BNC connector) 

cmb (Used to enable or disable interaction on the CMB. This does not affect 
whether measurement instruments can exchange triggers over the CMB; it only 
controls run/break interaction between multiple emulators) 

tarm (analyzer trace arm; used to specify arming (begin to search for trigger) 
conditions for the analyzer — trigl/trig2 can be used to arm the analyzer) 

tgout (specifies which of the trigl/trig2 signals are to be driven when the analyzer 
trigger is found) 
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cp - copy memory block from source to 
destination 

cp <dest_addr>=<addr> . . <addr> - copy range to destination address 

The cp command allows you to copy a block of data from one region of memory to 
another. 

When cp is executed, the data from the specified range is copied to the destination 
address, with the lower boundary data going to the destination address, lower 
boundary + 1 to destination + 1, and so on until the upper boundary of the source 
range is copied. 

The parameters are as follows: 

<dest_addr> Specifies the lower boundary of the destination range. 

<addr> Specifies the lower, and possibly upper, memory address boundaries of the source 

range to be copied. The default is a hexadecimal number; other bases may be 
specified. You can use "<addr>.." to specify a range from the address through the 
next 127 bytes. 



If the source or destination addresses reside within the target system, the emulator 
will break to the background monitor and will return to foreground after the copy is 
completed. 

If memory mapped as guarded is encountered in the source or destination range 
during the copy, the command is aborted; however, all locations modified prior to 
accessing guarded memory are left in the modified state. 

See Also m (allows you to display or modify memory locations or ranges) 

map (used to define the type and location of memory used by the emulator) 
ser (used to search memory ranges for a specific set of data values) 
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dt - display or set current date and/or time 



dt 

dt <yymmdd> 

dt <hh : mm : ss> 

dt <yymmdd> <hh:mm:ss> 



display current date and time 

set current date 

set current time 

set current date and time 



<yymmdd> 
<hh:mm:ss> 



The dt command allows you to set or display the current date and time stored by 
the HP 64700 series emulators. 

Note that the emulator system date & time clock is reset when power is cycled. 
If no parameters are specified, the current date and time settings are displayed. 
The parameters are as follows: 
Current date in year, month, day format. 
Current time in hour:minute:second format. 



Examples 



To display the current date and time settings at emulator powerup: 



M>dt 

January 01, 1988 0:00:21 



To set the date to August 18, 1987: 

M>dt 870818 



To set the date to August 18, 1987 and the time to 1 1:05:00 (the order of the two 
arguments is not significant): 

M>dt 870818 11:05:00 



Note that if yy is greater than 50, the year is assumed to be in the 20th century (in 
other words, 19yy). If yy is less than 50, the year is assumed to be in the 21st 
century (in other words, 20yy). 
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dump - upload processor memory in absolute file 
format 

dump -i <addr> . . <addr> - upload intel hex format 

dump -m <addr> . . <addr> - upload motorola S-record format 

dump -t <addr> . . <addr> - upload extended tek hex format 

dump -h <addr> . . <addr> - upload hp format (requires transfer protocol) 
dump -b <addr> . . <addr> - send data in binary (valid with -h option) 
dump -x <addr> . .<addr> - send data in hex ascii (valid with -h option) 
dump -c <hex char> <addr> . . <addr> - after uploading a hex ascii 

format file send this character 
to close the file 



-m 
-t 
-h 
-b 



-c <hex char> 
<addr> 



The dump command allows a host interface program to dump the contents of 
emulation and/or target system memory to a host file. The contents can be dumped 
in HP, Tektronix hex, Intel hex, and Motorola S-record formats by specifying 
various options on the command line. 

When uploading the file in HP file format using the HP 64000 transfer software, 
record checking is performed automatically by the transfer protocol. 

The parameters are as follows: 

Specifies in Intel hex record format. Note that the various options for HP file 
format transfer (such as -x, -b, and -e) are invalid with this format. 

Specifies the Motorola S-record format. 

Specifies the Tektronix extended hexadecimal format. 

Indicates that the memory contents will be dumped in HP absolute file format. 

Indicates that the records will be sent in binary; this is only valid with -h (HP file 
format). 

The records will be sent in hexadecimal; this is only valid with the -h option (HP 
file format). 

Indicates that the ASCII hexadecimal character specified should be sent to the host 
at the end of the file upload. 

Specifies the lower, then upper, address boundaries of the memory range to be 
dumped. The default is a hexadecimal number; other bases may be supplied. 
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dump - upload processor memory in absolute file format 

Note that the HP 64000 format ".X" file created with a "dump -hx" command has 
records that contain 136 fewer bytes of data than the file format standard allows. 
Because of this, HP 64000 format ".X" files which are created with the dump 
command may take longer to be processed by consumers of the ".X" file 
(depending on how the consumer processes sequential records). 

See Also load (used to load emulation memory from a host computer file) 
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echo - evaluate arguments and display results 

echo "string" - echo string to output 

echo 'string' - echo string to output 

echo expression - evaluate expression and display results in 

hex 

echo \<value> - echo character equal to value 

echo expression \<value> - multiple arguments may be evaluated 



string 



expression 
<value> 



The echo command allows you to display ASCII strings or the results of evaluated 
expressions on the standard output device. You must enclose strings in single open 
quote marks (') (ASCII 60 hex) or double quotation marks (") (ASCII 22 hex). A 
string not enclosed in delimiters will be evaluated as an expression and the result 
will be echoed. In addition, you may supply a backslash with a two digit hex 
constant; the corresponding ASCII character(s) will be echoed. 

Echoing strings or ASCII characters is particularly useful within macros, command 
files, and repeats where you wish to prompt the user to perform some action during 
a "wait for any keystroke" command (see description for w). The expression 
capability is useful as a quick calculator. 

Note that all options may combined within the same echo command as long as they 
are separated by spaces. 

The parameters are as follows: 

Any set of ASCII characters enclosed between single open quote marks ('), or 
double quotes ("). Since the command buffer is limited to 256 characters, the 
maximum number of characters in a string is 248. 

Note that many keyboards (and printers) represent the single open quote mark as an 
accent grave mark. In any case, the correct character is ASCII 60 hexadecimal. 
The correct double quote character is ASCII 22 hexadecimal. 

Note that a character which is used as a delimiter cannot be used within the string. 
For example, the string "Type "C"" is incorrect and will return an error. The 
string 'Type "C" is correct. 

A valid expression. The expression will be evaluated and the result will be echoed. 

Is the hex code for any valid ASCII character. More than one character can be 
echoed with a single command; each "nn" must be preceded by a backslash. A total 
of 62 ASCII characters can be represented within a single echo command. 
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This capability is particularly useful for sending non-displaying control characters 
to a terminal; refer to the examples below. 



Examples To echo the string "Set SI to OFF" to the standard output, type the following: 

M>echo "Set SI to OFF " 

Set SI to OFF 

A useful application of the backslash option is to send a terminal control characters: 

M>echo \lb "H" \lb "J" \lb "SdBSet SI to OFF" 

The above command sends "<ESC>H<ESC>J<ESC>&dB Set SI to OFF" to the 
terminal. On an HP 2392A terminal this homes the cursor, clears the screen, sets 
the video mode to inverse video, and writes the message "Set SI to OFF". 
Therefore, the user would see the message "Set SI to OFF" in inverse video at the 
upper left hand corner of an otherwise blank screen. 

You might combine this with a macro command as part of a procedure. For 
example, type: 

M>mac PROMPT={echo "Set SI to OFF";w} 
M>PROMPT 

You will see: 

Set SI to OFF 

Waiting for any keystroke... 

To calculate the value of the expression (If + le), type: 

M>echo lf+le 

03dh 

See Also mac (grouping a set of commands under a label for later execution) 

rep (grouping a set of commands for immediate repetition) 
w (wait command, allows user specified delays) 



236 



Chapter 9: Commands 
equ - define, display or delete equates 



equ - define, display or delete equates 



equ 


name=<value> 


- equate name to number or pattern 


equ 


name 


- display named equate 


equ 


-d name 


- delete named equate 


equ 


-d * 


- delete all equates 


equ 




- list all equates 


equ 




- list all equates 


equ 


namel=<value> name2 


- multiple operands allowed 



The equ command allows you to equate arithmetic values with names that you can 
easily remember; these names can then be used in other commands to reference the 
value. 

A number of equates have been predefined for common analyzer status values. The 
equates are present after the emulator is powered up or initialized. 

The parameters are as follows: 

name A character string that names the equate to be displayed, deleted, or assigned a 

value. The name must be an alphanumeric designator no greater than 31 characters 
in length, beginning with an alpha character or underscore and including only 
alphanumeric characters or underscores thereafter. 

<value> An arithmetic expression to be assigned to the equate name. 

-d Deletes the named. 



Note that each equate is translated to its actual value at the time of command entry. 
For example, if you specify an equate count=21h; and an expression start=2000h, 
then the command tg addr=start count will be entered into the system as tg 
addr=start 33. At this point, redefining the value of addr or count would not 
change the address expression or the occurrence counter for the trigger. 

Note that the combination of a single equ command with all names and expressions 
cannot exceed 255 characters. The number of equates and symbols that may be 
defined is limited only by available system memory; thus, it is dependent on the 
number of equates, symbols, macros, etc. defined. 
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See Also tg, tpat, tif, telif, and others, (equ provides an easy way to name expressions to 

use in setting up trigger or branch conditions) 

r, m, bp (equates may be used to specify run addresses, memory addresses, or 
breakpoint addresses) 
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es - display current emulation system status 

es 

The es command displays the current status of emulation activity. The following 
types of information may be displayed: 

R - emulator in reset state 

U - running user program 

M - running monitor program 

W - waiting for CMB to become ready 

T - waiting for target system reset 

c - no target system clock 

r - target system reset active 

h - processor halted 

g - bus granted 

b - no bus cycles 

? - unknown state 

The emulator will not break to the monitor to obtain information. Therefore, any 
information that can only be obtained while in the monitor will not be displayed if 
the emulator is not in the monitor. 

See Also ta (allows you to display activity on emulation and external analyzer lines) 

ts (allows you to display the current status of the emulation analyzer) 
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<expr> - analyzer state qualifier expressions 



In the easy configuration: 

any/all 

none/never 

arm 

<label>=<value> 
<label> ! =<value> 

<label>=<value> and <label>=<value> . 
<label> ! =<value> or <label> ! =<value> 
<label>=<value> . .<value> 
<label> ! =<value> . . <value> 



always true set 
always false set 
external qualifier 
define state qualifier 
define state qualifier 
state and state 
state or state 
define state range 
define notstate range 



In the complex configuration: 

any/all 
none/never 
<setl> 
<set2> 

<setl> and <set2> 
<setl> or <set2> 



- always true set 

- always false set 

- single set 

- single set 

- set global and set 

- set global or set 



<label> 
<value> 

<set1> 
<set2> 



Analyzer state qualifier expressions are used in specifying triggers, time qualifiers, 
primary and secondary branch conditions, prestore qualifiers, and other analyzer 
setup items. 

There are two types of analyzer expressions, simple and complex. 
The parameters are as follows: 

A trace label that is currently defined via either the tlb or xtlb commands. 

Values are numeric constants, equates, or symbols. Also, values can be the result 
of constants, equates, and symbols combined with operators. Refer to the <value> 
description. 

Consists of: pi, p2, p3, p4, r, !r. The pattern resources are assigned values with the 
tpat command and the range resource is assigned a value with the trng command. 

Consists of: p5, p6, p7, p8, arm. The pattern resources are assigned values with the 
tpat command. The "arm" keyword specifies the arm condition as specified in the 
tarm or xtarm commands. 



Resources within a set can be combined with intraset operators. Resources between 
the two sets can be combined with the interset operators. 
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Intraset Operators 

You use intraset operators to form relational expressions between members of the 
same set. The operators are: 

~ (intraset logical NOR) 
I (intraset logical OR) 
The operators must remain the same throughout a given intraset expression. 

Interset Operators 

You use interset operators to form relational expressions between members of set 1 
and set 2. The operators are: 

and (interset logical AND) 

or (interset logical OR) 

You can then form the following types of expressions: 
(set 1 expression) and (set 2 expression) 

(set 1 expression) or (set 2 expression) 

The order of sets does not matter: 

(set 2 expression) and (set 1 expression) 

Combining Intraset and Interset Operators 

You can use both the intraset and interset operators to form very powerful 
expressions. For example: 

pl~p2 and p5 | arm 
p3 or p6~p7~p8 

However, you cannot repeat different sets to extend the expression. The following 
is invalid: 

pl~p2 and p5 and p3 and p7 

DeMorgan's Theorem and Complex Expressions 

At first glance, it seems that you only have a few operators to form logical 
expressions. However, using the combination of the simple and complex 
expression operators, along with a knowledge of DeMorgan's Theorem, you can 
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form virtually any expression you might need in setting up an analyzer 
specification. 

DeMorgan's theorem in brief says that 
A NOR B = (NOT A) AND (NOT B) 

and 

A NAND B = (NOT A) OR (NOT B) 

The NOR function is provided as an intraset operator. However, the NAND 
function is not provided directly. Suppose you wanted to set up an analyzer trace 
of the condition 

(addr=2000) NAND (data=23) 

This can be done easily using the simple and complex expression capabilities. 
First, you would define the simple expressions as the inverse of the values you 
wanted to NAND: 

tpat pi addr!=2000 
tpat p2 data! =23 

Then you would OR these together using the intraset operators: 

pl| P 2 

This is effectively the same as: 

(NOT addr=2000) OR (NOT data=23) = (addr=2000) NAND (data=23) 

If you need an intraset AND operator, you can use the same theory. Suppose you 
actually wanted: 

(addr=2000) AND (data=23) 

First, define the simple expressions as the inverse values: 

tpat pi addr!=2000 
tpat p2 data! =23 

Then you would NOR these together using the intraset operators: 

pl~p2 

This is effectively the same as: 

(NOT addr=2000) NOR (NOT data=23) = (addr=2000) AND (data=23) 



Examples Some easy configuration examples include: 

tg addr=2000 
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tif 1 data=20. .30 

telif addr!=3000 or data! =5 

Some complex configuration examples include: 

First, to assign values to pattern names: 

tpat pi addr=2000 
tpat p2 addr!=3000 
tpat p5 data ! =5 
trng data=20 . . 30 

Next, to create complex expressions within the analyzer commands: 
tg pi 

tif 1 r 

telif 1 p2 or p5 3 

To use intraset operators: 

To store pattern 1 NOR pattern 2 NOR range: 

tsto pl~p2~r 

To trigger on pattern 2 OR (NOT range): 
tg p2 | !r 
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help, ? - display help information 

help <group> - print help for desired group 

help -s <group> - print short help for desired group 

help <command> - print help for desired command 

help - print this help screen 

The help (?) command lets you display syntax, description and examples for any 
HP 64700 emulator Terminal Interface command. You may display a brief 
description for anything from a single command to command groups or the entire 
command set. Detailed information is available for single commands. 

You may enter a question mark ? instead of typing help; it performs the same 
function. 

The parameters are as follows: 
<group> The valid group names are: 



gram 


System grammar. 


proc 


Processor specific grammar. 


sys 


System commands. 


emul 


Emulation commands. 


trc 


Analyzer trace commands. 


xtrc 


External trace analysis commands. 


* 


All command groups. 



-S Switches to the abbreviated help mode; only the expanded name of each command 

is displayed next to the command. 

<C0mmand> Detailed help information is displayed for the named command. 

Note that if you specify "*" for <command> or <group>, information for all 
commands will be displayed. 
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init - reinitialize system 

init - limited initialization; resets emulation and analysis 

products 

but not environment (macros, equates, date & time, etc..) 
init -c - complete initialization; does not run system memory 
integrity tests 

init -p - powerup initialization; run from reset with complete 

system verification tests 
init -r - powerup initialization; run from reset with complete 

system verification tests 

ignore all optional products 

do not use flash ROM 



The init command allows you to re-initialize the emulator. Powerup, complete, and 
limited initializations are available through various options. In most cases you 
should only use this command if the emulator is not responsive to other commands. 

If no options are specified, a limited initialization sequence is performed. The 
operating system and data communications are not affected but all of the emulation 
and analysis boards are reset. For example, a limited initialization would not 
change macro definitions, system date and time, or the data communications 
parameters, but the emulation memory map and breakpoint list would be reset to 
their default states. 

The parameters are as follows: 

Specifies a powerup initialization sequence. This initializes the operating system, 
data communications, emulation and analyzer boards, and runs extensive 
performance verification. 

Specifies a complete initialization sequence. Everything is initialized as defined by 
the powerup sequence with the exception of the performance verification. 

Specifies a complete initialization with system verification tests (as with -p), but 
optional products and the flash ROM are ignored. 

Note that the init -c, init -p, or init -r commands cause a loss of system memory. 
If these commands are used in macros, commands that follow them will not be 
executed. 



See Also cf (change emulation configuration) 
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dt (set system date and time) 
map (define the emulation memory map) 
stty (set data communications parameters) 
tinit (reset the analyzer to powerup defaults) 
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io - display or write processor io address 

io <addr> - display io at address 

io -d<dtype> <addr> - display io at address with display option 

io <addr>=<value> - set io at address to <value> 

io <addr> <addr>=<value> - multiple arguments accepted 

The parameters are as follows: 

-d<dtype> The -d option allows you to set the display mode for memory accesses. The valid 

display modes are: 



b display size is 1 byte(s) 

w display size is 2 byte(s) 

d display size is 4 byte(s) 

m display processor mnemonics 



<addr> Specifies the I/O address to be displayed or modified. The address default 

representation is a hexadecimal number. 

<value> Data value to which a particular I/O location is to be modified. Note that data may 

be specified in decimal, octal, or binary in addition to the hexadecimal default. 
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Ian - set configuration parameters 



lan 

lan -1 

lan -b 

lan -a 

lan -i <ip_addr> 

lan -g <ip_addr> 

lan -p <port> 



display the current lan configuration 
startup lan if not already started 
enable BNC 
enable AUI 

set Internet Protocol address 

set Internet Protocol Gateway address 

set TCP service port number 



-I 

-b 
-a 

-i <ip_addr> 
-g <ip_addr> 
-p <port> 



The parameters are as follows: 

Selects the LAN interface without having to change the HP 64700 configuration 
switch settings. Note that the serial interface is always active. 

Selects the LAN interface's BNC connector without having to change the 
HP 64700 configuration switch settings. 

Selects the LAN interface's AUI connector without having to change the HP 64700 
configuration switch settings. 

Internet Address in dot notation (for example, 192.6.94.2). 
Gateway Address in dot notation (for example, 192.6.94.2). 
Any number that is likely to be unused (for example, 6470). 
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lanpv - performance verification on LAN interface 

lanpv -b - testing performed through BNC connector 
lanpv -a - testing performed through AUI connector 
lanpv -v - print the error code value 

To run performance verification, the connector under test must be removed from 
the network and capped with a terminator. 

The parameters are as follows: 

-b Tests the LAN interface through its BNC connector. 

-a Tests the LAN interface through its 15-pin AUI connector. 

-V Prints the error code value. The error codes and their meanings are: 
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load - download absolute file into processor 
memory space 



load 


-i 


- download intel hex format 


load 


-m 


- download motorola S-record format 


load 


-t 


- download extended tek hex format 


load 


-S 


- download symbol file 


load 


-h 


- download hp format (requires transfer protocol) 


load 


-a 


- reserved for internal hp use 


load 


-e 


- write only to emulation memory 


load 


-u 


- write only to target memory 


load 


-f 


- download foreground monitor code 


load 


-b 


- data sent in binary (valid with -h option) 


load 


-x 


- data sent in hex ascii (valid with -h option) 


load 


-q 


- quiet mode 


load 


-p 


- record ACK/NAK protocol (valid with -imt options) 



The load command lets you load program code into emulation or target memory. 
Various file formats are supported via options to the load command. The 
destination of the program code is determined by the information contained in the 
program file. Additional options allow you to load only target memory or 
emulation memory as desired. 

If a load error occurs, the current load procedure is aborted. However, records 
which were successfully loaded will remain in memory. 

Note that at least one dash (-) must be included before any parameters are specified. 
It is optional to include or omit dashes for succeeding parameters. At least one file 
format option must be specified. 

The parameters are as follows: 

-i Specifies that the program code will be in Intel hex file format. 

-m Specifies that the program code will be in Motorola S-record file format. 

-t Specifies that the program code will be in extended Tektronix hexadecimal file 

format. 

-h Specifies that the program code will be in HP file format. In this case, the file is 

expected to be transferred using the HP 64000 Hosted Development System 
transfer protocol. 

-e Load only those portions of program code which would reside in memory mapped 

to emulation memory space. (Refer to the map command.) 
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-U Load only those portions of program code which would reside in memory mapped 

to target memory space. (Refer to the map command.) 

-f Download custom foreground monitor code. After you download the code, you 

must configure the emulator to use the custom foreground monitor by entering the 
cf mon=ufg command. 

-q The program code will be transferred in quiet mode. If -q is not specified, the 

emulator controller will write a "#" for each record successfully received and 
processed. 

S This allows you to download a symbol file from the host computer into the 

emulator. 

-b When using the HP file format, the program is expected to be in binary. 

-X When using the HP file format, the program is expected to be in hex. 

-p When using Intel, Motorola or Tektronix file formats, this option sets up a protocol 

checking scheme using ASCII ACK/NAK characters. If using this option, the host 
should send one record at a time and wait for the emulator to return an ASCII ACK 
character between records. If the emulator returns an ASCII NAK instead, there 
has been an error in data transmission. When the emulator receives the EOF 
character, it will return only the normal emulator prompt since data transmission is 
complete. 

If, during the transfer, the host receives a NAK for a record, it should retransmit the 
record until an ACK is received or until a timeout value is reached, whichever 
occurs first. 



Note that when you load an absolute file, the incoming data is examined for valid 
records (in the specified format). If the data being sent does not contain any valid 
records, the emulator will wait forever looking for valid records. The process must 
be terminated be entering a <CTRL>c. 

See Also dump (allows you to transfer emulation memory contents to a host) 
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m - display or modify processor memory space 

m <addr> - display memory at address 

m -d<dtype> <addr> - display memory at address with display option 

m <addr> . . <addr> - display memory in specified address range 

m -dm <addr> . . <addr> - display memory mnemonics in specified range 

m <addr> . . - display 128 byte block starting at address A 

m <addr>=<value> - modify memory at address to <value> 

m -d<dtype> <addr>=<value> - modify memory with display option 

m <addr>=<value>, <value> - modify memory to data sequence 

m <addr> . . <addr>=<value>, <value> - fill range with repeating sequence 

The m command allows you to display and modify emulation and target system 
memory. Options allow you to specify the display mode, specific address or 
addresses for display or modification, and the data values to be inserted. 

At least one address must be specified. If no display mode is specified the display 
mode set by the mo command is used. Data items specified in memory 
modification are repeated as a group to fill the address range specified. The 
memory display defaults to the last value specified, or the default format for the 
emulator in use upon powerup initialization (varies dependent on the 
microprocessor being emulated). 

If the selected address range for display or modification includes memory within 
the user's target system, emulator execution must break to the monitor in order to 
perform the access. After the command is complete, the processor will be returned 
to foreground execution if no errors occurred. 

The parameters are as follows: 

-d<dtype> The -d option allows you to set the display mode for memory accesses. The valid 

display modes are: 

b display size is 1 byte(s) 

w display size is 2 byte(s) 

d display size is 4 byte(s) 

m display processor mnemonics 

<addr> Specifies the address to be displayed or modified. As noted in the syntax, an 

address followed by two periods and another address specifies a range of addresses 
to display or modify. The address default representation is a hexadecimal number. 
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<value> Data value to which a particular location is to be modified. If a range of locations 

is to be modified to a sequence of data values, the values must be separated by 
commas. Note that data may be specified in decimal, octal, or binary in addition to 
the hexadecimal default. 

Note that the way the data item is handled depends on the display mode in effect. 
For example, if the display mode is byte, and the value entered is Ia3f66, the 
location specified will be modified to 66 hex. If the display mode is short, the 
location will be modified to 3f66 hex. And if the display mode is word, the 
location will be modified to Ia3f66. 

Conversely, if you specify the value 33 hex for modification in byte mode, the 
value 33 is entered; in word mode, the value 0033 is entered; in long word mode, 
the value 000033 is entered. In other words, if the value supplied is shorter than the 
mode in effect, it is padded with leading zeros. 

See Also map (specify mapping of memory to emulation or user memory and to RAM or 

ROM) 

mo (specify global access and display modes) 
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mac - display, define, or delete current macros 



mac 




- display currently defined macros 


mac 


<name> 


- display macro <name> 


mac 


<name>= { <cmd_list> } 


- define macro <name> as list of commands 


mac 


-d <name> 


- delete macro <name> 


mac 


-d * 


- delete all macros 


mac 


-q 


- set expansion echo to quiet mode 


mac 


-v 


- set expansion echo to verbose mode 



The mac command allows you to save a group of commands under a name of your 
choice. This allows you to instantly recall that command group by typing in the 
assigned name. The emulator will then preprocess the macro to expand the 
commands stored in it to a normal command line. Then, the command line is then 
executed. 

The parameters are as follows: 

-d The -d parameter, in conjunction with the macro <NAME>, deletes the macro 

defined by <NAME>. If <NAME> is given as the character "*" then all macros are 
deleted. 

<name> This represents the name you assign to the macro definition. Names can be any 

combination of alphanumeric characters; however, you cannot define a macro that 
has a name identical to that of another HP 64700 Terminal Interface command. 

If you specify a name which is the same as a currently defined macro, that macro 
will be overwritten by the new macro you define. 

<cmd_list> This represents one or more emulator commands, including names which are used 

to define other macros. Commands in <cmd_list> must be separated from other 
commands by a semicolon (;). 

When using command substitution, you can include pseudo-parameters in the form 
of "&token&" in the macro definition. Do not include any white space between the 
two "&" symbols. When you execute the macro, include the string to be substituted 
for &token& as a parameter on the command line. The macro will execute using 
the command expanded with the string you substituted. 

-q Sets the macro expansion echo to quiet mode. In this mode, any macro that you run 

will be executed without displaying the expanded command string. 

-V Sets the macro expansion echo to verbose mode. In this mode, any macro that you 

run will first display the expanded command string as a comment, and then will 
execute the macro. 
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Nested macro calls are permitted and limited only by constraints of system memory. 

The commands within the macro definition are not checked for correct syntax until 
the macro is executed; therefore, it is advisable to test the command string before 
defining the macro. 

The number of macros that can be created is limited to 100, but may be less 
depending on the complexity of the macros defined. 

The length of the macro name combined with the macro definition is limited only 
by the maximum HP 64700 command length of 255 characters; thus, the macro 
name and definition can be a maximum of 25 1 characters. 

A command within a macro definition cannot contain the pound sign character (#) 
unless the command is enclosed in a quoted string. (Otherwise, text following the # 
is interpreted as a comment.) This means there can be no matching brace at the end 
of the command. Use the echo command to place comments in a macro definition. 

Command line substitution is possible when invoking a macro. During the macro 
definition, you may include pseudo-parameters which allow you to substitute 
parameters, such as file names, when invoking the macro. 

See Also rep (repeat; allows you to repeat any command, including macros) 
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map - display or modify the processor memory 
map 



map 

map <addr> . . <addr> <type> <attrib> 
map other <type> 
map -d <term #> 
map -d * 



- display current map structure 

- map address range as memory type 

- map other range as memory type 

- delete specified map term 

- delete all map terms 



Because the emulator can use target system memory or emulation memory (or 
both), it is necessary to map ranges of memory so that the emulator knows where to 
direct its accesses. 

Up to 16 ranges of memory can be mapped, and the resolution of mapped ranges is 
1 Kbytes (that is, the memory ranges must begin on 1 Kbyte boundaries and must 
be at least 1 Kbytes in length). 



The parameters are as follows: 



<addr> Specifies the address range to be mapped. 

Other Specifies unmapped address ranges. The trom, tram, erom, eram, or grd types 

can be specified for unmapped memory. When you specify an emulation memory 
type, you can include the <attribute> parameter. 

The "other" range is unaffected when all mapper terms are deleted with the map -d 
* command. 

<type> The valid types are: 



eram Indicates that the given address range is to reside in emulation 

address space and act as RAM (read/write). 

erom Indicates that the given address range resides in emulation 

address space; it is to act as ROM (read only). 

tram Indicates that the given address range lies within target system 

RAM space. When the emulation processor accesses an address 
within this range, the target system data buffers will be enabled 
by a mapper signal to complete the transaction. 

trom Indicates that the given address range lies within target system 

ROM space. 
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grd The grd parameter indicates the given address range is to be 

"guarded". An emulation system break will be generated upon 
accesses to guarded memory. 

<attrib> The valid emulation memory attributes are: 

lock Specifies that accesses in a range of emulation memory be 

synchronized with the target system RDY. This means the 
termination of accesses in the range will not occur until the 
target system provides a ARDY or SRDY. 

nolock Specifies that accesses in a range of emulation memory are not 

synchronized with the target system RDY. This attribute, or no 
attribute, means emulation memory accesses are terminated by 
a RDY signal generated by the emulator. 

-d <term #> Delete the mapped address range. The emulation system assigns a term number to 

each mapped address range. Term numbers are assigned in ascending order of 
address range. 



When any map term is added or deleted the emulation processor will be reset and 
held in the reset state until a break or run command is issued. The processor 
remains reset in recognition of the fact that returning to execution directly after 
mapper modification is most likely invalid. 

Be sure to disable all software breakpoints (be -d bp) before changing the map. 
Software breakpoints are not cleared when the memory map is changed. After the 
new map and the program are set up, you can re-enable the breakpoints break 
condition (be -e bp) and enter the bp -e * command to reenable the defined 
software breakpoints. 

Note that the memory mapper re-assigns blocks of emulation memory after the 
insertion or deletion of mapper terms. 
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See Also be (break conditions; determines whether emulator breaks to monitor upon write to 

space mapped as ROM) 

m (memory display/modify) 

bp (set/delete software breakpoints) 
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-a<atype> 



-d<dtype> 



See Also 



mo - set or display current default mode settings 



The mo command allows you to modify the global access and display modes. 
Access mode is defined as the type of processor data cycles used by the emulation 
monitor to access a portion of user memory. Display mode is defined as the 
method used to display or modify data resident in memory. 

The parameters are as follows: 

The -a option allows you to set the access mode. The valid access modes are: 
d the same as the display mode 

b byte, display size is 1 byte(s) 

w word, display size is 2 byte(s) 

The -d option allows you to set the display mode. The valid display modes are: 

b byte, display size is 1 byte(s) 

w word, display size is 2 byte(s) 

d double word, display size is 4 byte(s) 

m display processor mnemonics 

At powerup or after init, the default access mode is set to b (byte) and the default 
display mode is set to w (word). 

m (memory display/modify) 



mo 

mo -d<dtype> 
mo -a<atype> 



- display current mode settings 

- set display mode to specified type 

- set access mode to specified type 
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po - set or display prompt 

po - display the current port settings 

po -p "string" - change the prompt string 

The po command allows you to change the system prompt characters. 

The parameters are as follows: 

-p Allows you to change the emulator' s command prompt to one specified by 

<STRING>. 

String Any group of ASCII characters enclosed by single open quotes (') or double (") 

quote marks. 
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pv - execute the system performance verification 
diagnostics 

pv - display pv warning message 

pv <repeat_count> - execute diagnostics <repeat_count> number of times 



CAUTION The pv command performs a system powerup initialization after all pv execution is 

completed. Therefore, all equates, macros, memory map, configuration settings, 
system clock, software breakpoints, trace specifications, and other configuration 
items you have altered will be cleared. 



The pv command runs performance verification on the emulator and analyzer. The 
performance verification exercises all the emulator hardware and software to high 
confidence level. 

You should only run performance verification when the emulation probe is plugged 
into the demo board. 

The parameters are as follows: 

<repeat_COUnt> Specifies the number of times to repeat the performance verification. 



If pv reports failures, first check your hardware installation as described in the 
"Installation" chapter. If the failures persist, call your local HP Sales and Service 
office for assistance. A list of offices is provided in the Support Services guide. 

Note that providing multiple commands such as pv l;r is invalid; the second 
command will not execute due to the system reset. 

Typing in <CTRL>c to abort the pv command may result in incorrect failure 
messages. 

See Also ink (reinitializes the emulator) 
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r - run user code 



r $ 

r <addr> 
r rst 



r 



- run from current Program Counter 

- run from current Program Counter 

- run from address <addr> 

- run from processor reset 



<addr> 
rst 

See Also 



The r command starts an emulation run. Execution begins at the address specified 
by the <addr> parameter; if no address is specified, execution begins at the address 
currently present in the program counter. 

The parameters are as follows: 

Specifies the address where execution is to begin. If you specify $, the processor 
runs from the current program counter value. 

Specifies that the emulation processor runs from reset. 

s (step; allows controlled stepping through program instructions) 

rx (run only when CMB (Coordinated Measurement Bus) execute pulse is received) 

x (pulse the CMB execute line if resident on the CMB) 
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reg - display and set registers 

reg - display all basic register contents 

reg * - display all basic register contents 

reg <reg> - display contents of the named reg 

reg <regclass> - display contents of the named reg class 

reg <reg>=<value> - modify contents of the named reg 

reg <reg> <reg>=<value> <regclass> - display and set may be combined 



The reg command allows you to display and modify emulation processor register 
contents. Individual registers may be displayed or modified; related groups of 
registers may be displayed; combinations of display and modify are permitted on 
the same command line. 

The parameters are as follows: 

<reg> 

<regclass> Refer to the following table. 

<value> A numeric value. 



Register Class 


Register 


Description 


* 


ah, al, ax, bh, bl, 
bx, ch, cl, cx, dh, 
dl, dx, bp, si, di, 
ds, es, ss, sp, ip, 
cs, fl 


All Basic Registers 


gen 


ax, bx, cx, dx 


General Registers 


seg 


ds, es, ss, cs 


Segment Registers 


po- 


bx, bp, si, di, ds, 

es 


Pointer Registers 


pes 

(80186/8/XL/EA 
Peripheral chip 
select registers) 


umcs 

lmcs 

pacs 

mmcs 

mpes 


Upper Memory Chip Select 
Lower Memory Chip Select 
Address of Peripheral Chip Select Block 
Mid-Range Memory Chip Select 
Mode of Peripheral Chip Selects 
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Register Class 


Register 


Description 


pes 


gcs0-7st 


Generic Chip-Select 0-7 Start 


\0\J 1 Ou/ 0/ CD/ Lv 


^csu / sp 


vjeneiic v^iup-oeieci u / oiop 


Peripheral chip 


lesst 


Lower Chip-Select Start 


select registers) 


lessp 


Lower Chip-Select Stop 




ucsst 


Upper Chip-Select Start 




ucssp 


Upper Chip-Select Stop 


rr 


rfbase 


Refresh Base 


(Refresh 


rftime 


Refresh Timer 


controller 


rfcon 


Refresh Control 


registers) 


rfaddr 


i~« r i ajj /o a i of icy /t - '"pi /~\ i \ 

Refresh Address (80186/8/EB Only) 


nic 

r 


polls ts 


Poll Status 


(Programmable 


imask 


Tnterrnnt Mask 


interrupt 


primsk 


Priority Mask 


controller 


inserv 


In-Service 


registers 


reqst 


Tnterrnnt Renuest 


80186/8/XL/ 


intsts 


Interrupt Status 


EA/EB) 


tcucon 


Timer Control 




dmaOcon 


r»A ft a f\ f~i j i s or\A of 10 r\7~~i n~" a f~\ i \ 

DMA 0 Control (80186/8/XL/EA Only) 




dmalcon 


T~\Tl M A 1 /~1 a 1 / f)A1 Of IO r\.7"f n — 1 A /" ~\ 1 \ 

DMA 1 Control (80186/8/XL/EA Only) 




scucon 


Serial Control Unit (SCU) Control (80186/8/EB Only) 




iOcon 


T\] ty \ /"^ 4 1 

INTO Control 




ileon 


INT1 Control 




i2con 


IN 1 1 Control 




i3con 






i4con 


INT4 Control (80186/8/EB Only) 


pic 


mpicpO 


Master Programmable Interrupt Controller acces port 0 


(80186EC) 


mpicpl 


Master Programmable Interrupt Controller "acces port" 1 




spicpO 


Slave Programmable Interrupt Controller "acces port" 0 




spicpl 


Slave Programmable Interrupt Controller "acces port" 1 




scuirl 


Serial Communications Interrupt Request Latch 




dmairl 


DMA Interrupt Request Latch 




timirl 


Timer Interrupt Request Latch 


to 


tOcnt 


Count 


(Timer 0 


tOcmpa 


Max Count A 


mode/control 


tOcmpb 


Max Count B 


registers) 


tOcon 


Mode/Control 
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Register Class 


Register 


Description 


tl 


tlcnt 


Count 


(Timer 1 


tlcmpa 


Max Count A 


mode/control 


tlcmpb 


Max Count B 


registers) 


tlcon 


Mode/Control 


t2 


t2cnt 


Count 


(Timer 2 


t2cmpa 


Max Count A 


mode/control 


t2cmpb 


A It 4- 1~1 

Max Count B 




IZCOI1 


ivioue/^.oiiuoi 


dO 


dOsrcl 


Source Pointer Low 


, 1 — v X jf" A ~1 1 1 

(DMA Channel 


dOsrch 


Source Pointer High 


0 registers - 


dOdstl 


Destination Pointer Low 


80186/8/XL/EA/ 


dOdsth 


Destination Pointer High 


EC Only) 


dOtc 


Transfer Count 




dOcon 


Control Word 




dmapri 


DMA Module Priority (80186/8/EC only) 




Ullldllll 


FtMA Unit f RO 1 Rft/R/Fr" nnKA 


dl 


dlsrcl 


Source Pointer Low 


(DMA Channel 


dlsrch 


Source Pointer High 


1 registers - 


dldstl 


Destination Pointer Low 


80186/8/XL/EA/ 


dldsth 


Destination Pointer High 


EC Only) 


dltc 


Transfer Count 




dlcon 


Control Word 




dmapri 


DMA Module Priority (80186/8/EC only) 




dmahlt 


DMA Halt (80186/8/EC only) 


d2 


d2srcl 


Source Pointer Low 


(DMA Channel 


d2srch 


Source Pointer High 


2 registers - 


d2dstl 


Destination Pointer Low 


80186/8/EC 


d2dsth 


Destination Pointer High 


Only) 


d2tc 


Transfer Count 




d2con 


Control Word 




dmapri 


DMA Module Priority 




dmahlt 


DMA Halt 
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d3 


d3srcl 


Source Pointer Low 


(DMA Channel 


d3srch 


Source Pointer High 


3 registers - 


d3dstl 


Destination Pointer Low 


80186/8/bC 


d3dsth 


Destination Pointer High 


Only) 


d3tc 


Transfer Count 




d3con 


Control Word 




LlllldlJlI 


r^lVT A 1VT r\rliil Prir\rit\7 
L/.VlrA 1V1UUU1C r lHJULy 




dmahlt 


DMA Halt 


sO 


bOcmp 


Channel 0 Baud Rate Select 


(Serial 


bOcnt 


Channel 0 Baud Rate Count 


Controller 


sOcon 


Channel 0 Control 


Channel 0 


sOsts 


Channel 0 Status 


registers - 












Only) 






si 


blcmp 


Channel 1 Baud Rate Select 


(Serial 


blent 


Channel 1 Baud Rate Count 


Controller 


si con 


Channel 1 Control 




s 1 sts 


^.Ildllliei 1 OLdLUS 


registers - 






80186/8/EB/EC 






Only) 






wdt 


wdtrldh 


Watchdog Timer Reload Value High 


(Watchdog 


wdtrldl 


Watchdog Timer Reload Value Low 


Timer registers- 


wdtcnth 


Watchdog Timer Count Value High 


80186/8/EC 


wdtcntl 


Watchdog Timer Count Value Low 


Only) 






Pi 


pldir 


Port 1 Pin Direction 


(I/O Port 1 


plpin 


Port 1 Pin Value 


registers - 


pi con 


Port 1 Pin Control 


80186/8/EB/EC 


plltch 


Port 1 Pin Latch 


Only) 
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Register Class 


Register 


Description 


p2 


p2dir 


Port 2 Pin Direction 


(I/O Port 2 


p2pin 


Port 2 Pin Value 


registers - 


p2con 


Port 2 Pin Control 


80186/8/EB/EC 


p21tch 


Port 2 Pin Latch 


Only) 






P 3 


p3dir 


Port 3 Pin Direction 


(I/O Port 3 


p3pin 


Port 3 Pin Value 


registers - 


p3con 


Port 3 Pin Control 


80186/8/EC 


p31tch 


Port 3 Pin Latch 


Only) 







See Also s (step; allows you to step through program execution — combination with the reg 

command is useful in debugging) 
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<value> 



<cmd list> 



See Also 



rep - repeat execution of the command list 
multiple times 

rep <value> { <cmd_list> } - execute the command list <value> number 

of times 

rep 0 {<cmd_list>} - execute the command list forever 

<cmd_list> - list of valid commands separated by semicolons 

The rep command allows you to repeat a group of commands and macros a 
specified number of times. 

No other command input will be accepted until the command group has executed 
the indicated number of repetitions. 

The parameters are as follows: 

An integer value specifying how many times the command list should be executed. 
A count of zero is a special case, meaning "repeat forever" (the repetition can be 
terminated by entering <CTRL>c, which issues a break signal to the emulator). 

Any valid HP 64700 command, including previously defined macros, may be 
specified with the options appropriate to the command. The list of commands must 
be preceded by an opening brace and followed by a closing brace. Also, the 
commands must be separated by semicolons. The commands will be executed in 
the same order as they are specified on the command line. 



mac (allows assignment of a name to a command group for easy recall of a 
specified command sequence) 
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rst - reset emulation processor 

rst - reset and stay in reset state 

rst -m - reset, then enter monitor 

The rst command resets the emulation microprocessor. An option allows you to 
specify that the processor should begin executing the emulation monitor code 
immediately after the reset. If -m is not specified, the emulation processor remains 
in the reset state. Note that any commands which require the emulation processor 
to execute the monitor code for command processing will not execute while the 
processor is in the reset state; these include commands such as reg. 

Commands or hardware signals which will take the emulator out of a reset state 
include b, r, s, and the CMB /EXECUTE pulse. 

The parameters are as follows: 

-m Causes the emulator to begin executing monitor code immediately after the reset. 
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rx - run at CMB-execute 



rx - display run-at-CMB-execute address 

rx $ - when CMB-execute occurs, use the PC value at that time 

rx <addr> - set run-at-CMB-execute address 



The rx command allows you to set the starting address for synchronous CMB 
(Coordinated Measurement Bus) execution. 

The parameters are as follows: 

<addr> Specifies where to start program execution when the CMB EXECUTE pulse is 

detected. If $ is specified for address, the current program counter value is used 
(default). 



If the HP 64700 emulator is connected to the CMB, and the CMB-EXECUTE pulse 
is detected, followed by the CMB-READY line in the true state, the emulator will 
begin execution at the address specified by the rx command. If no rx command 
has been issued, execution begins at the current program counter value (same as rx 
$). 

Execution will begin at the address specified by rx every time the conditions listed 
above are met. For example, if you type the command rx 100, the emulator will 
start executing at address 100 hex every time the CMB-EXECUTE line is pulsed. 

The rx command automatically turns on CMB interaction by effectively 
performing the equivalent of a cmb -e command whether or not you have done so. 

See Also cmb (enables or disables CMB interaction) 

x (initiates a synchronous CMB interaction by pulsing the CMB-EXECUTE line) 
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s - step emulation processor 



s 




- step 


one from current PC 




s 


<count> 


- step 


<count> 


from 


current 


PC 


s 


<count> $ 


- step 


<count> 


from 


current 


PC 


s 


<count> <addr> 


- step 


<count> 


from 


<addr> 




s 


-q <count> <addr> 


- step 


<count> 


from 


<addr>, 


quiet mode 


s 


-w <count> <addr> 


- step 


<count> 


from 


<addr>, 


whisper mode 



<count> 



<addr> 



-q 



-w 



The s command allows you to single-step the emulation processor through a 
program. You can specify the number of steps to execute at a single time; or, you 
can direct the emulator to step continuously. In addition, you may specify the 
starting address for stepping. 

The parameters are as follows: 

Specifies the number of steps to execute in sequence before returning command 
control. 

The default base for <decimal> is decimal; however, other number bases may be 
specified. 

If you do not specify a value for <count>, then a value of one (1) is assumed. If 
you specify a step count of zero (0), the emulator interprets this as "step 
continuously". Continuous stepping can be aborted with the <CTRL>c command; 
or, it will be terminated upon receipt of an emulation break condition such as a 
write-to ROM. 

Specifies the starting address for stepping. If you substitute $ for the <addr> 
parameter, the current program counter value will be used as the <addr> value. The 
same will occur if no address parameter is specified. 

Note that if you specify a value for <addr>, then you must specify a value for 
<count>. Otherwise, the address value will be interpreted as a step count; the 
emulator will step the number of locations specified. 

Stepping will occur in quiet mode; that is, the instructions and program counter are 
not displayed upon execution of each step. 

Stepping will be done in whisper mode; only the final program counter value is 
displayed after the step is executed. 
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If the emulator was in the ran state (U> prompt) executing a user program when 
you request the step, it will break to the monitor program before executing the step. 

Note that when the Coordinated Measurement Bus (CMB) is being actively 
controlled by another emulator, the step command (s) does not work correctly. The 
emulator may end up running in user code (NOT stepping). Disable CMB 
interaction (cmb -d) while stepping the processor. 

See Also r (run emulation processor from a specified address) 

reg (view or modify processor register contents) 
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ser - search through processor memory for 
specified data 

ser <addr> . . <addr>=<value> - search for data value in range 

ser -d<dtype> <addr> . . <addr>=<value> - search with display option 
ser <addr> . . <addr>=<value>, <value> - search for data sequence in 

range 

ser <addr> . . <addr>="CDE" - search for string "CDE" in 

range 



<addr> 



<value> 



-d<dtype> 



The ser command allows you to search memory for a data value, a character string, 
or a combination of both. For every pattern match, the starting address of the 
match is displayed. 

Using the -d (display mode) option, the method of interpreting the pattern supplied 
by the user can be altered. If no option is given, the display mode used is taken 
from global default set by the mo command. 

The parameters are as follows: 

Specifies first the lower, and possibly the upper, address boundaries of the memory 
range to search for the given data pattern. You can use "<addr>.." to specify the 
range from the address through the next 127 bytes. 

Either a numeric expression or a string to be used as a reference pattern in the 
search. 

Strings must be bounded by single open quote marks (') or double quotes ("). 

Note that many keyboards (and printers) represent the single open quote mark as an 
accent grave mark. In any case, the correct character is ASCII 60 hexadecimal. 
The correct double quote character is ASCII 22 hexadecimal. 

Note that if the character string you are searching for contains double quotes, you 
must delimit the string with single open quotes and vice versa. For example, the 
string "Type "C"" will return an error; the string 'Type "C" is correct. 

Allows you to specify the display mode used for the search. The valid display 
modes are: 



w 



display size is 1 byte(s) 
display size is 2 byte(s) 
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d display size is 4 byte(s) 



If addresses specified in the search reside in target system memory, the emulator is 
broken to the monitor and returned to the user program when the command is 
completed. 

Note that you can concatenate various combinations of values to form more 
complex search patterns by separating the parameters with commas (,). 

See Also cp (used to copy the contents of one memory range to another) 

m (used to display/modify memory locations) 
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stty - set or display current communications 
settings 



stty <port> <options> 



Parameter 


<options> 


Parity 


noparity, evenp, onep, zerop 


Character Size 


cs7, cs8 


Baud 


300, 1200, 2400, 4800, 9600, 19200, 38400, 
57600, 1 15200, 230400, 460800 


Protocol 


rs232, rs422 


Stop Bits 


lstopb, 2stopb 


Request/Clear to Send 


crts, -crts 


Data Set/Terminal Rdy 


cdsr, -cdsr 


Start/Stop 


xon, -xon 


Line Terminator 


onlcr, ocrnl, ocr, onl 


Echo 


echo, -echo 


Data Term/Comm Equip 


dte, dee 



The stty command allows you to modify the parameters of the serial data 
communications port without changing the configuration switch settings. 

The serial port, port A, may be modified by stty. 

The powerup default configuration for the serial port is determined by the rear 
panel configuration switches; refer to the "Installation" chapter for more 
information. 

The parameters are as follows: 
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rs232 RS-422 utilizes balanced transmission lines and therefore can achieve much higher 

rs422 data rates with reliability over long distances than RS-232. Otherwise, the 

interfaces are similar. 

dte The serial port may be set to operate either as Data Communications Equipment 

dee (DCE) or as Data Terminal Equipment (DTE). This configures the handshake lines 

and transmit/receive lines for the proper signal to pin relationships on the interface. 

onlcr Generate new-line and carriage-return on output. 

OCml Generate carriage-return and new-line on output. 

OCr Generate carriage-return on output. 

onl Generate new-line on output. 

crtS The option crts enables the Request To Send/Clear To Send handshake. Specifying 

-crtS -crts disables this handshake. 

cdsr The option cdsr enables exchange and recognition of the Data Set Ready/Data 

-Cdsr Terminal Ready status lines. Specifying -cdsr disables the exchange. 

xon If you specify xon, the system generates XON/XOFF (DC1/DC3 characters) 

-xon software handshaking to control the amount of data received at a given time. 

Specifying -xon disables this handshake sequence. 



(When the emulator's receive buffer is full, it will send a DC3 (XOFF) character to 
the host to stop transmission; when it is ready for more data, it will send a DC1 
(XON) character to restart transmission.) 

Note that if you toggle the xon parameter when running at 1200 baud and below, 
the stty command will return invalid characters. The PC Interface attempts to do 
this when starting up and fails with a datacomm error. To get around this problem, 
set switch 13 on the emulator's back panel (enable xon) to allow the PC Interface to 
start up successfully. In the Terminal Interface, just enter another carriage return to 
regain proper communications. 

echo If you specify echo, all characters received by the emulator datacomm are echoed 

-echo back to the sending system. Specifying -echo means the system will not echo back 

characters received. 

You will normally use this in conjunction with the echo settings required by your 
host computer and your terminal. Most Hewlett-Packard systems will require that 
you enable the echo feature, as HP host computers automatically echo characters 
back to data terminal devices. 
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For further information on the meanings of various data communications 
parameters, you may refer to the book entitled Touring Datacomm: A Data 
Communications Primer. This book is orderable from HP's Direct Marketing 
Division under the part number 5957-4622. Another book which may be helpful is 
The RS-232 Solution, orderable from HP under the product number 92234X. You 
also may need to refer to the hardware and software reference manuals that are 
supplied with your terminal and/or host computer for further information on 
required data communications parameters for links to those devices. 



Examples To display the current data communications settings: 

M>stty 

stty A 9600 cs8 lstopb noparity dee rs232 -crts cdsr -xon onlcr echo 

To set the baud rate to 1200 baud: 

M>stty 1200 
M>stty 

stty A 1200 cs8 lstopb noparity dee rs232 -crts cdsr -xon onlcr echo 



277 



Chapter 9: Commands 

sym - define, display or delete symbols 



sym - define, display or delete symbols 



sym 
sym 
sym 
sym 
sym 
sym 
sym 
sym 
sym 
sym 
sym 
sym 



<name> 
-g <name> 
-u <name> 
-1 

-1 <name> 

<name>=<addr> 

-d 

-du 

-du <name> 
-dg 

-dl 

-dl <name> 



- display all or named symbols 

- display all or named global symbol 

- display all or named user symbol 

- display all local modules 

- display symbols in local module 

- define user symbol 

- delete all symbols 

- delete all user symbols 

- delete named user symbol 

- delete all global symbols 

- delete all local symbols in all modules 

- delete all local symbols in module 



The sym command defines, displays, or deletes symbols in the emulator. The sym 
command without any parameters displays all of the symbols currently defined. 

Three types of symbols are supported: global, local, and user. Global symbols 
reference addresses anywhere in memory using an absolute reference. Local 
symbols also use absolute addressing but are grouped within a "module." User 
symbols are defined at the command line. Global and local symbols cannot be 
defined at the command line. 

The definition of a module for grouping local symbols depends on the environment 
being used. For local symbols created by a high-level language, a module might be 
a function, a procedure, or a separately compilable source file. When you define 
local symbols through the use of a symbol file, a module, in effect, becomes a 
technique to manage the symbols. It can be a mnemonic device to refer to modules, 
or it can be a simple way to group local symbols into a set for display and deletion 
purposes since the sym command facilitates manipulation of local symbols by their 
module name. 

Symbols are used like equated variables. When using symbols in expressions, only 
the + and - operators can be used immediately before and after the symbol name. 
The expression can contain literals and equated (equ) labels, but not other symbols. 

When using symbols, if a symbol and an equated value have the same name, the 
equated value will be used. 

The symbol table can be updated in three ways: 

• You can enter user symbols at the command line. 

• You can update it from an external "symbol file" using the load -So command. 



278 



Chapter 9: Commands 
sym - define, display or delete symbols 

• You can load an absolute file (such as an IEEE-695 file) which can contain 
symbols as well as program code. 

A "symbol file" is a text file containing user-specified symbols. 

The parameters are as follows: 

<name> This represents the symbol label to be defined or referenced. The format of the 

symbol name reference is determined by the type of symbol, where: 

name Is a user symbol or module name. 

:name Is a global symbol name. 

name: Is a local module name. 

module:name Is a symbol name in a local module. 

In addition, symbols can be referenced using a "wild card" expression when 
displaying and deleting names. Only one wildcard character can appear in a 
symbol name. An asterisk ("*") character is used to represent zero or more 
characters at the end of a symbol name. A wildcard can be used in any of the 
following symbol types: 

name* Represents a user symbol name followed by zero or more of 

any character or characters. 

:name* Represents a global symbol name followed by zero or more of 

any character or characters. 

module:name* Represents a local module:symbol followed by zero or more of 
any character or characters. 



<addr> Specifies the value to assign to a user symbol, 

-d Deletes all symbols. 

-du Deletes user symbols. If a <name> parameter is not included, all user symbols are 

deleted. If a <name> parameter is included, only user symbols matching the 
entered name are deleted. 

-dg Deletes all global symbols. No option exists to delete one global symbol. 
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-dl Deletes local symbols in a module. If a <name> parameter is not included, all local 

symbols are deleted for all modules. If a <name> parameter is included to specify a 
module name, only local symbols in the module matching the entered name are 
deleted. 



-g Specifies the display of global symbols. If a <name> parameter is not included, all 

global symbols are displayed. If a <name> parameter is included, only global 
symbols matching the entered name are displayed. 

-I This option allows you to display local modules and symbols. If a <name> 

parameter is not included, all local modules are displayed. If a <name> parameter is 
included, only local symbols matching the symbol name or module are displayed. 

-U This option allows you to display user symbols. If a <name> parameter is not 

included, all user symbols are displayed. If a <name> parameter is included, only 
user symbols matching the entered name are displayed. 

See Also equ (used to equate names to expressions) 

load (used to load a program file with symbols, or a symbol text file) 
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t, xt - start a trace 

t - start an emulation trace 
xt - start an external trace 

The t and xt commands start emulation and external traces, respectively. These 
commands (or tx if making a synchronous CMB execution) must be entered to 
actually begin a measurement; most other trace commands are used only for 
specification of triggering, sequencer, and storage parameters; or to display trace 
results or status. 

If the external analyzer has been linked to the emulation analyzer via the xtmo 
command, the xt command is invalid and both analyzers begin a trace when the t 
command is entered. 

See Also r (starts a user program run; normally will be specified after entering the t 

command) 

th (halts a trace in process) 

ts (allows you to determine the current status of the emulation analyzer) 
tx (specifies whether a trace is to begin upon start of CMB execution) 
x (begins synchronous CMB execution) 

xtmo (specifies whether or not the external analyzer bits are to be treated as a 
separate analyzer or integrated with the emulation analyzer. If associated with the 
emulation analyzer, the xt command is invalid; the t command starts the trace on 
both analyzers.) 



281 



Chapter 9: Commands 

ta - current status of analyzer signals is displayed 



ta - current status of analyzer signals is displayed 

ta 

The ta command allows you to display the activity on each of the analyzer input 
lines. Each signal may be low (0), high (1), or moving (?). 

Each pod (group of 16 lines) is displayed on a single line with bit 0 (LSB) at the far 
right and bit 15 (MSB) on the far left. 

See Also xtv (used to set the threshold voltages for the optional external analyzer inputs; 

incorrect specification may show up as lack of activity in a ta display) 
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tarm, xtarm 



specify the arm condition 



tarm <signal> 



arm the emulation analyzer 



xtarm <signal> 



- arm the external analyzer 



=trig1 
=trig2 
!=trig1 



!=trig2 



The tarm (xtarm) command allows you to specify an arming condition for the 
emulation and external analyzers. You can specify the arm condition as the 
assertion of the trigl or trig2 signals or as tarm always. 

The trigl or trig2 signals can be asserted from many sources including the analyzer 
itself or the rear panel BNC connector or the CMB. See bnct, cmbt, and tgout for 
examples. 

The arm condition may be used in specifying the analyzer trigger or in specifying 
branch conditions for the sequencer, as well as count or prestore qualifiers. 

If the analyzers are connected through use of the xtmo command, then the xtarm 
command is invalid. In this case, the tarm command will set the arming condition 
for the analyzer combination. 

If no parameters are supplied, the current tarm condition is displayed. The default 
setting after powerup or tinit is tarm always. 

The parameters are as follows: 

The assertion of the trigl signal will arm the analyzer. 
The assertion of the trig2 signal will arm the analyzer. 

If the trigl signal is asserted when the analyzer is started, the analyzer can never be 
armed. 

If the trigl signal is not asserted when the analyzer is started, the analyzer is armed 
immediately. 

If the trig2 signal is asserted when the analyzer is started, the analyzer can never be 
armed. 

If the trig2 signal is not asserted when the analyzer is started, the analyzer is armed 
immediately. 

The analyzer is always armed. 
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Note that if the external analyzer is configured to operate as a timing analyzer 
(xtmo -t) then the != operator is invalid when used in the xtarm command as given 
to the external analyzer. Only the = operator will be recognized. 

See Also be (can be used to cause the emulator to break to monitor execution upon receipt of 

the trigl and/or trig2 signals) 

bnct (used to define connections between the internal trigl and trig2 signals and the 
rear panel BNC connector) 

cmbt (used to define connections between the internal trigl and trig2 signals and 
the CMB trigger signal) 

tgout (defines whether or not the trigl or trig2 signals are driven when the analyzer 
finds the trigger state) 
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tcf, xtcf - set or display trace configuration 



tcf 
tcf 
tcf 



e 



c 



- display trace configuration 

- set complex trace configuration 

- set easy trace configuration 



xtcf 
xtcf 
xtcf 



-e 



-c 



- display trace configuration 

- set complex trace configuration 

- set easy trace configuration 



The tcf (xtcf) commands are used to set the configuration for the emulation 
(external) analyzer. There are two possible configurations for the analyzer, an easy 
configuration (tcf -e) and a complex configuration (tcf -c). 

The easy configuration hides some of the complexity of the analyzer sequencer and 
makes it easy to use. The complex configuration gives you greater capability when 
using the sequencer and gives you greater flexibility when using expressions to 
qualify states. 

In the easy configuration, you can insert up to five sequence terms in the sequencer. 
The branch out of the last sequence term constitutes the trigger. 

In the complex configuration, there are always eight terms in the sequencer. Any 
of the sequence terms except the first may be specified as the trigger term. Entry 
into the trigger term constitutes the trigger. 

In the complex configuration, up to eight pattern resources and one range resource 
may be used in trace commands wherever state qualifier expressions are used in the 
easy configuration. These patterns are grouped in to sets and may be combined with 
set operators to specify more complex qualifiers. 

If no parameters are supplied, the current analyzer configuration is displayed. After 
powerup or tinit, the default analyzer configuration is tcf -e. 

The parameters are as follows: 



-e 



Sets the analyzer to the easy configuration. 



-C 



Sets the analyzer to the complex configuration. 



See Also 



tarm (used to set the analyzer arm specification; this specification can only be used 
in analyzer expressions in complex configuration) 
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telif (sets the global restart in easy configuration, secondary branch condition in 
complex configuration) 

tg (used to set a trigger expression in either analyzer configuration) 

tif (sets primary branch specification in either analyzer configuration) 

tpat (used to label complex analyzer expressions with a pattern name; the pattern 
name is then used by the analyzer setup commands. Only valid in complex 
configuration) 

tpq (specifies trace prestore qualifier in either analyzer configuration) 

trng (defines a range of values to be used in complex analyzer expressions) 

tsto (specifies a qualifier to be used when storing analyzer states) 

tsq (used to modify the trace sequencer's number of terms and trigger term) 

xtmo (used to append or disconnect the external analyzer to/from the emulation 
analyzer) 
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tck, xtck - set or display clock specification for 
the analyzer 



tck 
tck 
tck 
tck 
tck 
tck 
tck 
tck 



-r <clock> 
-f <clock> 
-x <clock> 
-1 <clock> 
-h <clock> 
-b 
-u 

-s <speed> 



clock analyzer on rising edge of clock 
clock analyzer on falling edge of clock 
clock analyzer on either edge of clock 
qualify on low level of clock 
qualify on high level of clock 
qualify when emulation in background 
qualify when emulation in user 
define the clock speed 



xtck -r <clock> - clock analyzer on rising edge of clock 

xtck -f <clock> - clock analyzer on falling edge of clock 

xtck -x <clock> - clock analyzer on either edge of clock 

xtck -1 <clock> - qualify on low level of clock 

xtck -h <clock> - qualify on high level of clock 

xtck -b - qualify when emulation in background 

xtck -u - qualify when emulation in user 

xtck -s <speed> - define the clock speed 



The tck (xtck) command allows specification of clock qualifiers and master edges 
of the master clocks used for the emulation and external analyzers. 

The tck command is included with the system for the purpose of internal system 
initialization and system control through high-level software interfaces. 

You should ONLY use the tck command when you wish to trace background 
execution or perhaps to qualify the emulation analyzer clock on some external 
signal. In other words, do not change the the "tck -r L" setting. 

If you are using the external analyzer as an independent state analyzer, you will use 
the xtck command to specify and qualify the clock signal for the external analyzer. 

The parameters are as follows: 

<clock> Five clock signals are defined: J, K, L, M, and N. 

The L, M, and N clocks are generated by the emulator. The L clock is the 
emulation clock derived by the emulator, the N clock is used as a qualifier to 
provide the user/background tracing options (-u and -b) to tck, and the M clock is 
not used. The L and N clocks may also be used to clock and qualify the external 
analyzer as well as the emulation analyzer. 

The J and K clocks are the clock inputs on the external trace probe (if one is 
present). These clock signals should only be used to clock the external trace; they 
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should not be used to clock the emulation trace although it may occasionally be 
useful to use the external clock signals as qualifiers for the emulation trace. 

r The analyzer is clocked on the rising edge of the indicated clock signal. 

f The analyzer is clocked on the falling edge of the indicated clock signal. 

X The analyzer is clocked on both the rising and falling edges of the indicated clock 

signal. 

I Qualifies the analyzer clock so that the analyzer is only clocked when this clock 

signal is low (less positive/more negative voltage). 

h Qualifies the analyzer clock so that the analyzer is only clocked when this clock 

signal is high (more positive/less negative voltage). 

-b The analyzer is only clocked when the emulator is executing in background (in 

other words, the background monitor). 

-U The analyzer is only clocked when the emulator is executing in foreground (in other 

words, the user program). This is the default. 

-S <speed> Specifies the maximum qualified clock speed. The <speed> parameter can be: 

S SLOW, less than or equal to 16 MHz. 

F FAST, between 1 6 MHz and 20 MHz. 

VF VERY FAST, between 20 MHz and 25 MHz. 

Changing the clock speed affects the tcq command parameters. When speed is set 
to S (slow), the tcq command may either count states or time. When speed is set to 
F (fast), the tcq command may be used to count states but not time. If clock speed 
is set to VF (very fast), tcq cannot count either state or time and should be set to 
tcq none. 



If no parameters are specified, the current clock definitions are displayed. After 
powerup or tinit, the -u option is always set. 

When several clock edges are specified with the -r, -f, or -x options, any one of the 
edges clocks the given trace. If several qualifiers are specified with the -1 or -h 
options, they are ORed so that the trace is clocked when any of the qualifiers are 
met. 
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Note that the -u and -b qualifiers are ORed with all of the other qualifiers specified. 

See Also ta (display current trace signal activity. This can be useful after you have modified 

the clocks for the external analyzer; you can issue a ta command and verify that 
you are seeing activity on the signals of interest.) 

tcq (specifies the trace count qualifier as states, time, or none. The maximum 
qualified clock speed set by tck -s affect which tcq parameters are valid.) 

tsck (used to define slave clock signals used by the analyzer; tck defines the master 
clock signals. Default mode for tsck is off on all pods.) 

xtv (specifies threshold voltages for external analyzer input lines; must be set 
correctly to ensure that the J and K clock signals are recognized) 

xtmo (specifies mode of operation for the external analyzer; that is, whether it acts 
as an independent analyzer or is appended to the emulation analyzer) 
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tcq, xtcq - set or display the count qualifier 
specification 

tcq - display count qualifier specification 

tcq time - define count on time 

tcq <expr> - define count on state 

xtcq - display count qualifier specification 

xtcq time - define count on time 

xtcq <expr> - define count on state 



The tcq (xtcq) command allows you to specify a qualifier for the emulation 
(external) trace tag counter. 

When the tag counter is active, the analyzer counts occurrences of the expression 
you specify (which may include simple or complex expressions (depending on 
analyzer configuration), time, or none). Each time a trace state is stored, the value 
of the counter is also stored and the counter is reset. The tag counter shares trace 
memory with stored states, so only half as many states can be captured by the 
analyzer when the tag counter is active. (The analyzer can store 1024 states with 
tcq none, 512 states otherwise.) 

If no parameters are given, the current count qualifier is displayed. Upon powerup 
or after tinit initialization, the clock qualifier defaults to the state tcq time. 

The parameters are as follows: 

time If you specify time rather than an analyzer expression, the trace tag counter 

measures the amount of time between stored states. 

Note that the tcq time qualifier is only available when the analyzer clock speed is 
set to the slow (S) speed setting (default). If the clock speed is set to very fast 
(VF), then trace tag counting must be turned off by specifying tcq none. Refer to 
the tck command (analyzer clock specification) for further information. 

<expr> State qualifier expression. Refer to the <expr> description in this chapter. 

Note that the count qualifier tcq arm is not permitted in any configuration. 

See Also tck (used to specify the clock source and clock parameters for the analyzer) 

tp (specifies position of the trigger within the trace; note that tcq affects the 
number of states the analyzer can store and therefore may affect trigger positioning) 
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tpat (assigns analyzer expressions to pattern names in complex configuration; the 
pattern names are then used to specify qualifiers in other analyzer commands such 
as tcq) 

trng (specifies a range of values to be used as a complex mode qualifier; this range 
definition can be used as a count qualifier by tcq) 

tsq (used to manipulate the trace sequencer) 

xtmo (used to choose the external analyzer mode; the external analyzer can operate 
as an independent state or timing analyzer, or it may be appended to the emulation 
analyzer. If appended, the xtcq command has no effect and the tcq command 
specifies the count qualifier for both analyzers.) 
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telif, xtelif - set or display secondary branch 
specification 

In the easy configuration: 

telif - display global restart specification 

telif <expr> - define global restart specification 

xtelif - display global restart specification 

xtelif <expr> - define global restart specification 



In the complex configuration: 

telif - display all secondary branch specifications 

telif X - display secondary branch specification X 

telif X <expr> - define secondary branch specification X 
telif X <expr> Y - secondary branch X will jump to Y (default next 
term) 



xtelif - display all secondary branch specifications 

xtelif X - display secondary branch specification X 

xtelif X <expr> - define secondary branch specification X 
xtelif X <expr> Y - secondary branch X will jump to Y (default next 
term) 



The telif (xtelif) command allows you to set the global restart qualifier (in easy 
configuration) for the emulation (external) analyzer sequencer. In complex 
configuration, telif (xtelif) lets you set the secondary branch qualifier for each term 
of the emulation (external) analyzer sequencer. 

Note that the telif command is used as a global restart qualifier in easy 
configuration and a secondary branch qualifier in complex configuration. The 
hierarchy of the tif and telif commands is such that either branch will be taken if 
found before the other; however, if both branches are found simultaneously, the tif 
branch is always taken over the telif branch. 

When in easy configuration, the sequencer will restart by jumping to sequencer 
term number one (1) when the expression specified by telif occurs. 

When in complex configuration, the sequencer will branch to the sequencer level 
specified by the Y parameter when the expression specified is found. There are 
always eight sequencer terms available. Position of the trigger term is defined with 
the tsq command. If both the tif and telif expressions are satisfied simultaneously, 
the tif branch is taken; otherwise, branching occurs according to which expression 
is first satisfied. 
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The parameters are as follows: 

<expr> State qualifier expression. Refer to the <expr> description in this chapter. 

X Specifies a sequence term number to associate with the given <expr>. When you 

associate a term number with a complex expression, that expression is only used as 
a secondary branch qualifier at the sequencer level specified by the term number. If 
you specify X without an expression, the secondary branch qualifier currently 
associated with that term number is displayed. 

Y Specifies the branch destination when <expr> is found. For example, if you wish to 

have the sequencer branch from term 1 to term 3 after the expression is found you 
would be specified as telif 1 <expr> 3. If you do not specify a term number, the 
default is to increment the sequencer level (telif X <expr> (X+l)). 

If telif is entered with no parameters, the global restart qualifier or secondary 
branch qualifiers (depending on analyzer configuration) for all sequencer levels are 
displayed. If telif is entered with only an X parameter in complex configuration, 
the secondary branch qualifier for only that term number is displayed. 

Upon initialization via a powerup sequence or the tinit command, the secondary 
branch specifiers are set to telif never. 

Note that the default branch to condition for sequence term 8 is 8; that is, branch to 
the same term. 

Note that if the tif expression for the given sequence term X has a <count> 
parameter other than one (1), the counter is reset to zero (0) if the telif branch is 
taken before the occurrence counter parameter is satisfied. For example, if the tif 
counter parameter is 7, and the tif expression has been found 5 times, then the telif 
expression is satisfied, the telif branch will be taken and the tif counter will be reset 
from 5 to 0. This might cause you difficulty if you happen to have telif branching 
back to the same term; your occurrence condition may or may not be satisfied. 



See Also tarm (allows you to specify that the trigl or trig2 signal will arm the analyzer. 

This arm condition can then be used as part of the secondary branch qualifier) 

tcf (used to select whether the analyzer is operated in easy configuration or 
complex configuration) 

tif (used to specify a primary branch specification for the analyzer) 
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tg (used to set up a simple trigger qualifier in either analyzer configuration. 
Specifying the tg command overrides the current sequencer specification and will 
modify the existing telif qualifier stored in sequence term number 1) 

tpat (used to assign pattern names to simple expressions for use in specifying 
complex expressions. These complex expressions are used to specify telif 
qualifiers in analyzer complex configuration) 

trng (used to set up an expression which assigns a range of values to a range 
variable. This range information may be used in specifying complex telif qualifiers) 

tsto (specifies a global trace storage qualifier in both easy & complex 
configurations; also specifies a trace storage qualifier for each sequencer term in 
complex configuration. Used to control the types of information stored by the 
analyzer) 

tsq (used to manipulate the trace sequencer) 

xtmo (specifies whether the external analyzer operates as an independent state or 
timing analyzer or is appended to the emulation analyzer. If appended to the 
emulation analyzer, the xtelif command is invalid; all secondary branch qualifiers 
are specified with the telif command) 
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tf, xtf - specify trace display format 

tf - display current format 

tf <label>, <base> - display the label in the specified base 

tf mne - disassembled mnemonic 

tf count - count, absolute (relative to trigger) 

tf count, a - count, absolute (relative to trigger) 

tf count, r - count, relative to preceding state 

tf seq - sequencer state change 

tf mne <label>, <base> count count, r seq 

- multiple fields may be specified 
tf addr,H mne count, r seq - default format 

tf addr, <base>, <width> - column width (addr column only) 



xtf - display current format 

xtf <label>, <base> - display the label in the specified base 

xtf count - count, absolute (relative to trigger) 

xtf count, a - count, absolute (relative to trigger) 

xtf count, r - count, relative to preceding state 

xtf seq - sequencer state change 

xtf <label>, <base> <label>, <base> count seq 

- multiple fields may be specified 
xtf xbits count, r seq - default format 



The tf (xtf) command allows you to specify which pieces of information from the 
emulation (external) analyzer trace will be displayed by tl (xtl) (trace list) 
commands. Each label represents a column in the trace list display. 

The parameters are as follows: 

<label> A label defined via the tlb or xtlb commands. The analyzer bits associated with 

that label will be displayed in a column of the trace listing. 

<base> Specifies the numeric base in which <label> is to be displayed. The choices are Y 

(binary), Q or O (octal), T (decimal), H (hexadecimal), or A (ASCII). The 
specifiers are not case sensitive. In ASCII mode, non printing characters are 
displayed as periods (.). If <base> is not specified, the default base is hexadecimal. 

mne Displays mnemonic information about a state. Depending on the trace list 

disassembler options (see tl -o), disassembled instructions may be displayed in this 
column. To ensure correct operation of mne, the predefined labels addr, data, and 
stat must not be redefined. The mne column is only allowed with the tf command, 
and not with xtf. 

count Absolute time counts are displayed. That is, the the time shown for each state is 

COUnt,a relative to the trigger state. 
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count.r 
seq 

<width> 



Relative time counts are displayed. That is, the time count shown for each state is 
relative to the previous state. 

If you specify seq, a "+" is displayed in the seq column for each state that causes 
the sequencer to branch from one term to another. 

This option allows you to set the width of the column for the "addr" predefined 
trace label to values from 4 to 50. A wider address field is useful when displaying 
symbols in the trace list. 

The minimum width is really defined by the base of the "addr" column. For 
example, if the 24-bit address is displayed in binary, the minimum width is 24. 



Note that changing the trace format DOES NOT change the type of information 
captured by the analyzer; it only specifies how the captured data should be 
displayed. 



See Also tl,xtl (displays the current data in emulation (external) trace memory according to 

the specifications set up by tf) 

tlb,xtlb (define labels which represent groups of emulation (external) analyzer 
input lines; these labels may be used to create special trace list displays by 
including the labels in the tf definition) 

xtmo (defines whether the external analyzer acts as an independent state/timing 
analyzer or is appended to the emulation analyzer) 
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tg, xtg - set and display trigger condition 

tg - display sequence term 1 primary branch 

tg <expr> - define trigger 

tg <expr> <count> - define trigger and occurrence count 

xtg - display sequence term 1 primary branch 

xtg <expr> - define trigger 

xtg <expr> <count> - define trigger and occurrence count 



The tg (xtg) command sets a trigger condition for the emulation (external) analyzer. 
When the expression specified occurs the number of times specified, the analyzer 
triggers. 

The parameters are as follows: 

<expr> State qualifier expression. Refer to the <expr> description in this chapter. 

<COUnt> Specifies the number of times the expression must occur before the trigger 

condition is satisfied. The <count> value specified must be from 1 to 65535. The 
default number base for <count> is decimal. If <count> is not specified, the 
occurrence count is 1 . 

If no parameters are specified, the current primary branch condition for sequencer 
term 1 is displayed. Note that this is not necessarily the trigger condition if other 
sequence terms are used. After powerup or tinit initialization, tg is set to tg any. 

The tg command modifies the current analyzer sequence specification. The manner 
in which the sequencer is modified is dependent upon the analyzer configuration. 

If the analyzer is in easy configuration (tcf -e), the sequencer is reduced to a one 
term sequence triggering upon exit from term 1 . The global restart qualifier is set 
to never (telif never); the primary branch condition is set to the specified trigger 
expression (tif 1 <expr> <count>). 

If the analyzer is in complex configuration (tcf -c), the sequencer is modified to 
trigger upon entrance to the second sequence term (tsq -t 2), the secondary branch 
qualifier is set to never (telif 2 never), and the primary branch qualifier for term 
number 1 is set to the specified expression (tif 1 <expr> 2 <count>). 

The analyzer storage qualifier (tsto) is not affected in either configuration; 
therefore, the analyzer uses the storage qualifier from the most recent tsto 
command. 
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See Also be (allows you to break the emulator to the monitor when various conditions occur; 

you can have the emulator break upon analyzer trigger by specifying tgout trigl 
and be -e trigl (or you could use the trig2 signal to perform the same function)) 

t (starts an emulation trace) 

tarm (used to specify an analyzer arm condition; the analyzer will not trigger until 
the arm condition is received if you specify tg arm) 

tcf (used to specify whether the analyzer is operated in easy or complex 
configuration) 

tpat (used to assign pattern names to simple analyzer expressions; the pattern 
names are then used in creating complex analyzer expressions which could be used 
with the tg command to trigger the analyzer) 

trng (used to specify a range of values for a particular group of analyzer lines; this 
range may be used in specifying complex analyzer expressions for triggering the 
analyzer) 

tsto (specifies which states encountered by the analyzer should be stored in trace 
memory) 

tsq (used to manipulate the trace sequencer. Note that the sequencer's current 
status is affected by the tg command.) 

xtmo (specifies whether the external analyzer is treated as a separate state or timing 
analyzer or is appended to the emulation analyzer. If appended to the emulation 
analyzer, the xtg command is no longer valid; tg sets the trigger condition for both 
analyzers.) 
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tgout, xtgout - specify signals to be driven by the 
analyzer 

tgout <signal> - find trigger then drive signal 
xtgout <signal> - find trigger then drive signal 

The tgout (xtgout) command allows you to specify which of the internal trigl 
and/or trig2 signals will be driven when the emulation analyzer (external analyzer) 
finds its trigger condition. 

The parameters are as follows: 

<signal> Specifies the internal signal to drive when the trigger is found. This signal can be: 

trigl The trigl signal is driven by the analyzer when the trigger state 

is found. 

trig2 The trig2 signal is driven by the analyzer when the trigger state 

is found. 

trigl,trig2 Both trigl and trig2 should are driven when the analyzer trigger 

is found. 

none Neither the trigl nor trig2 signals are driven when the analyzer 

finds its trigger state. 



If no parameters are specified, the current state of tgout is displayed. Upon 
powerup or tinit, the default state is tgout none. 

Note that if the analyzer is receiving trigl or trig 2 via the tarm command, then that 
signal cannot be driven, although no error message will be issued to that effect. 

If the external analyzer has been appended to the emulation analyzer via the xtmo 
command, then the xtgout command is invalid and the tgout command specifies 
the trigger signals to be driven when either analyzer finds its trigger. 

See Also be (allows you to specify a break to emulation monitor when the tgout condition is 

satisfied) 
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bnct (specifies whether or not trigl and trig2 are used to drive and/or receive the 
rear panel BNC connector signal line) 

cmbt (specifies whether or not trigl and trig2 are used to drive and/or receive the 
CMB trigger signal) 

tarm (used to specify that the analyzer will be armed upon assertion or negation of 
trigl or trig2) 
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th, xth - halt the trace 



th 

th -w 



- halt the 

- suppress 



emulation trace 
output and errors 



xth 

xth -w 



- halt the 

- suppress 



external trace 
output and errors 



The th (xth) command stops an emulation (external) trace. 



The parameters are as follows: 



-W 



Suppresses the output and errors. In other words, "Emulation trace halted" is not 
shown. 



If the external analyzer has been appended to the emulation analyzer with the xtmo 
command, the xth command is invalid and th halts both the emulation and external 
trace in process. 

The analyzer will stop driving the trigl and trig2 signals when the trace is halted. 
This may cause you difficulty in making measurements with instruments connected 
to the BNC. For example, if you set the analyzer to drive trigl (tgout trigl) when 
the trigger condition is found, then drive this to the BNC connector with bnct -d 
trigl, the BNC signal will be driven high when the analyzer finds its trigger while a 
trace is in progress; it will fall low when the trace finishes. 

You should start the trace after you have begun the external instrument' s 
measurement. Otherwise, the following measurement errors may occur, depending 
on the type of external instrument you are using: 

• With an edge sensitive instrument, starting the instrument after the analyzer 
trigger is found will mean that the instrument never sees the transition of the 
trigl line and therefore never triggers. 

• With a level sensitive instrument, starting the instrument after the analyzer 
trigger is found will mean that the instrument triggers immediately; although 
many states of interest have probably already passed. 

Note that if the analyzer trigger specification has not been found, you will need to 
use the th command to halt the analyzer before you can display the trace list. 
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See Also t (used to start an analyzer trace) 

ts (allows you to determine the current status of the emulation analyzer) 
tx (starts an analyzer trace upon receipt of the CMB execute signal) 
x (starts a synchronous CMB execution) 
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tif, xtif - set or display primary sequence branch 
specifications 

In the easy configuration: 

tif - display all primary branch specifications 

tif X - display primary branch X specification 

tif X <expr> - define primary sequence branch X 

tif X <expr> <count> - branch X jump to next term after count times 

xtif - display all primary branch specifications 

xtif X - display primary branch X specification 

xtif X <expr> - define primary sequence branch X 

xtif X <expr> <count> - branch X jump to next term after count times 

In the complex configuration: 

tif - display all primary branch specifications 

tif X - display primary branch X specification 

tif X <expr> - define primary sequence branch X 

tif X <expr> Y - define primary sequence branch X jump to Y 

tif X <expr> Y <count> - define branch X jump to Y after count times 

xtif - display all primary branch specifications 

xtif X - display primary branch X specification 

xtif X <expr> - define primary sequence branch X 

xtif X <expr> Y - define primary sequence branch X jump to Y 

xtif X <expr> Y <count> - define branch X jump to Y after count times 

The tif (xtif) command allows you to set the primary branch qualifier for each term 
of the emulation (external) analyzer sequencer. 

The parameters are as follows: 

X Specifies the sequence term whose primary branch qualifier is to be modified with 

the <expr> state qualifier. If you specify X without an expression, the tif qualifier 
for that term number is displayed. 

<expr> State qualifier expression. Refer to the <expr> description in this chapter. 

<COUnt> Specifies the number of times the expression must occur before the trigger 

condition is satisfied. The <count> value specified must be from 1 to 65535. The 
default number base for <count> is decimal. If <count> is not specified, the 
occurrence count is 1 . 

Note that, in the complex configuration, if you specify the <count> parameter, you 
must also specify a Y parameter. If you omit the Y parameter when specifying 
<count>, the system will interpret the count as "branch to term" information; if 
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greater than eight (8), an error will be returned; otherwise, you will have just 
specified an incorrect branch. 

Y Specifies the branch destination when the state qualifier is found. For example, if 

you wish to have the sequencer branch from term 1 to term 3 after the expression is 
found, this would be specified as tif 1 <expr> 3. If you do not specify a term 
number, the default is to increment the sequencer level (tif X <expr> (X+l)). 



If tif is entered with no parameters, the primary branch qualifiers for all sequencer 
levels are displayed. If tif is entered with only an X parameter, the primary branch 
qualifier for only that term number is displayed. 

Upon initialization via a powerup sequence or the tinit command, the primary 
branch specifiers are set to tif X any (X+l). 

Note that the telif command is used as a global restart qualifier in easy 
configuration and a secondary branch qualifier in complex configuration. The 
hierarchy of the tif and telif commands is such that either branch will be taken if 
found before the other; however, if both branches are found simultaneously, the tif 
branch is always taken over the telif branch. 

When in easy configuration, the sequencer will increment to the next sequencer 
level when the expression specified by tif occurs the number of times specified by 
the <count> parameter. There is a maximum of five sequence levels; only one is 
available at initialization. If you require more sequencer levels, you must insert 
them with the tsq command. (The term you are specifying a primary branch for 
with the tif command must be present in the sequence.) The branch out of the last 
sequencer term constitutes the trigger. 

When in complex configuration, the sequencer will branch to the sequencer level 
specified by the Y parameter when the expression specified occurs the number of 
times indicated in the <count> parameter. There are always eight sequencer terms 
available. Position of the trigger term is defined with the tsq command. 

Note that, in the complex configuration, at sequencer term number 8, the default 
branch to condition is also term 8; that is, branch to the same term. 

See Also tarm (allows you to specify that the trigl or trig2 signal will arm the analyzer. 

This arm condition can then be used as part of the primary branch qualifier) 

tcf (used to select whether the analyzer is operated in easy configuration or 
complex configuration) 
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telif (used to specify a secondary branch specification for the analyzer) 

tg (used to set up a simple trigger qualifier in either analyzer mode. Specifying the 
tg command overrides the current sequencer specification and will modify the 
existing tif qualifier stored in sequence term number 1) 

tpat (used to assign pattern names to simple expressions for use in specifying 
complex expressions. These complex expressions are used to specify tif qualifiers 
in analyzer complex configuration) 

trng (used to set up an expression which assigns a range of values to a range 
variable. This range information may be used in specifying complex tif qualifiers) 

tsto (specifies a global trace storage qualifier in both easy and complex 
configurations; also specifies a trace storage qualifier for each sequencer term in 
complex configuration. Used to control the types of information stored by the 
analyzer) 

tsq (used to manipulate the trace sequencer) 

xtmo (specifies whether the external analyzer operates as an independent state or 
timing analyzer or is appended to the emulation analyzer. If appended to the 
emulation analyzer, the xtif command is invalid; all primary branch qualifiers are 
specified with the tif command) 
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tinit - initialize emulation and external analyzers 
to powerup defaults 

tinit 



The tinit command restores all trace specification items to their powerup default 
values which are as follows: 



Trace Specification 


Default Value 


Analyzer arm 


tarm always 


Trace Configuration 


tcf -e 


Analyzer master clocks 


tck -r L -u -s F 


Trace format 


tf addr.H mne count.R 


Trace trigger 


tg any 
tgout none 


Analyzer signal line labels 


#### Emulation trace labels 
tlbaddr0..19 
tlb data 32. .47 
tlb stat 20.. 31 


Trigger Position 


tp s 


Trace Prestore Qualifier 


tpq none 


Trace sequencer (includes branch and 
store conditions) 


tif 1 any 
tsto all 
telif never 


Trace slave clocks 


tsck -o 1 
tsck -o 2 
tsck -o 3 
tsck -o 4 


Trace Upon Execute? 


tx -d # ignore the execute signal 
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See Also ink (used to initialize selected portions of the emulator or the entire emulator, 

dependent on the options given) 
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tl, xtl - display trace list 



ti 

ti * 

tl -d -15 . . 3 

tl -s 20 . . 30 

tl -a 50 . . 60 

tl -e 12. .25 

tl -h 

tl -n 3 

tl -t 123 

tl 10 . . 20 

tl -b 

tl -h -n -d 15 



display next states 
display all states 

display states -15 through 3, disassembled 

display symbols only in addr column 

display absolute addresses only in addr column 

display symbols and absolutes in addr column 

display next states, no header 

display next 3 states 

display top 123 states 

display states 10 through 20 

upload binary trace list 

some options may be combined 



xtl 
xtl * 
xtl -h 
xtl -n 3 
xtl -t 123 
xtl 10. .20 
xtl -b 
xtl -h -n 



-d 15 



- display next states 

- display all states 

- display next states, no header 

- display next 3 states 

- display top 123 states 

- display states 10 through 20 

- upload binary trace list 

- some options may be combined 



The tl (xtl) command allows you to display the current emulation (external) 
analyzer trace list information. 

If the trigger specification has not yet been satisfied, the trace list cannot be 
displayed until the trace in progress is halted with the th command. Entering the tl 
command before the trace is halted results in the message "** Trigger not in 
memory **." 

If the analyzer was halted before any states were captured, the message "** No 
trace data **" is displayed upon entry of the tl command. 

The parameters are as follows: 



-d 



Disassemble instructions in the trace. 



-S 



Display symbols in the address column. 



-a 



Display absolute addresses in the address column. This is the default. 



-e 



Display symbols and absolute addresses in the address column. 



-h 



Suppresses the display of column headers. 
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Display the next number of states of the trace. If you do not specify a number, the 
same number of states will be displayed as the last time you used tl to display part 
(but not all) of the trace. 

Displays the top number of states of the trace. If you do not specify a number, the 
number of states displayed is the same number as the last time tl was invoked to 
display part (but not all) of the trace. 

Dumps the trace list in binary format using the HP 64000 transfer protocol. 
Note that the -h and -d options cannot be used with the -b option. 



If no parameters are given, the trace list is displayed starting with the first state that 
has not yet been displayed. The number of states displayed is identical to the 
number of states displayed by the last tl command. For example, if the last trace 
list display was tl -t 5, then the next tl command will start the display at state 6 and 
display a total of five states. 

Note that the HP 64700 remembers the last option specified for the address field 
(-s, -a, or -e), and uses it for the next tl command if no other option is specified. 

See Also t (starts an analyzer trace) 

tf (specifies the display format for the trace) 
th (halts a trace in process) 

tlb (defines analyzer signal line labels; these may be used by tf in specifying the 
trace list display format) 

ts (allows you to determine the current status of the emulation analyzer) 
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tlb, xtlb - define and display trace labels 

tlb addr 0..15 - define addr, positive polarity, bits 

0 through 15 

tlb data 16.. 23 - define data, positive polarity, bits 

16 through 23 

tlb stat 24.. 31 - define stat, bits 24 through 31 

tlb stat 31.. 24 - define stat, bits 24 through 31; 

31.. 24 is the same bit range as 24.. 31 
tlb -n LRESET 25 - define LRESET, negative polarity, bit 25 

tlb -d LRESET - delete named label 

tlb -d * - delete all labels 

tlb addr - display named label 

tlb - display all labels 



xtlb MYLABEL 8 . . 12 
xtlb myStatus 3 
xtlb -n AuxBits 2.. 11 
xtlb -n AuxBits 11 . . 2 

xtlb -n LRESET16 7 

xtlb -d myStatus 
xtlb -d * 
xtlb LRESET16 
xtlb 



define MYLABEL, positive polarity, 
external analyzer bits 8 through 12 
define myStatus, positive polarity, 
external analyzer bit 3 
define AuxBits, negative polarity, 
external analyzer bits 2 through 11 
define AuxBits, negative polarity, 
external analyzer bits 2 through 11; 
11.. 2 is the same bit range as 2.. 11 
define LRESET16, negative polarity, 
external analyzer bit 7 
delete named external analyzer label 
delete all external analyzer labels 
display named external analyzer label 
display all external analyzer labels 



The tlb (xtlb) command allows you to define new labels for emulation (external) 
analyzer lines, as well as display or delete previously defined analyzer labels. 
Since labels are pre-defined for the address, data, and status lines of the emulation 
analyzer, xtlb will be the more frequently used command. 

The parameters are as follows: 

-d Delete the named label. If the label is currently used in a trace specification or in 

the trace display format (tf command), it will not be deleted until removed from all 
of the specifications. If * is used, all labels are deleted. 

-n Defines the named label with negative polarity. That is, after label definition, bits 

that are a one (1) refer to a signal lower than the threshold voltage and bits that are 
a zero (0) refer to a signal higher than the threshold voltage. If -n is not specified, 
the named label defaults to positive polarity. 
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If no parameters are specified, the current label definitions are displayed. Upon 
emulator powerup, or after a tinit command, the following labels are defined: 
M>tib 

#### Emulation trace labels 
tlb addr 0 . . 19 
tlb data 32 . . 47 
tlb stat 20 . . 31 

M>xtlb 

#### External trace labels 
xtlb xbits 0 . . 15 

Note that the predefined emulation trace labels are special labels, used for trace list 
disassembly. They should not be changed or deleted. 

The external analyzer has 16 lines that may be assigned to labels, numbered 0 
through 15, where 0 is the least significant bit. The emulation analyzer has 48 
lines, where 0 is the least significant bit. 

In emulation analyzer labels, no more than 32 signal lines may be assigned to a 
given label. Also, an emulation analyzer label may not cross more than a multiple 
of 16 boundary. For example, a label cannot be defined for emulation analyzer 
lines 15. .32 since one multiple of 16 boundary is crossed from 15 to 16 and another 
boundary is crossed from 31 to 32. 

Labels are made up of alphanumeric characters; upper and lower case are 
distinguished. Labels can be up to 31 characters in length. 

Labels can be made to overlap; for example, you may wish to define a label for a 
particular status line or data bit so that you can easily track its state in the trace list. 

The number of labels that can be defined is limited only by system memory. 

See Also tf (used to specify the trace list format; tlb <LABEL> definitions can be specified 

as output columns in the trace listing through the tf command) 

tpat (trace pattern definition; labels defined in tlb can be used in pattern definitions) 

trng (trace range, used to specify a range of valid values to be used in a trace 
specification; labels defined by tlb may be used in defining the trace range) 

xtv (threshold voltage setting for analyzer lines; tlb can be used to define positive 
and negative logic for labels encompassing those lines) 
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tp, xtp - set and display trigger position within 
the trace 



tp - display trigger position 

tp s - trigger position start of the trace 

tp c - trigger position center of the trace 

tp e - trigger position end of the trace 

tp -b <offset> - trigger is offset states from beginning of trace 

tp -a <offset> - trigger has offset states after the trigger 



xtp - display trigger position 

xtp s - trigger position start of the trace 

xtp c - trigger position center of the trace 

xtp e - trigger position end of the trace 

xtp -b <offset> - trigger is offset states from beginning of trace 

xtp -a <offset> - trigger has offset states after the trigger 



The tp (xtp) command allows you to specify where the trigger state will be 
positioned within the emulation (external) trace list. 

The position number specified has an accuracy of +/- 1 state when counting states 
or time; when counts are turned off, the accuracy is +/- 3 states. 

The parameters are as follows: 

S The trigger is positioned at the start of the trace list. 

C The trigger is positioned at the center of the trace list. 

e The trigger is positioned at the end of the trace list. 

-b Indicates that the trigger is to be placed in the trace list with <offset> number of 

states before the trigger position to the beginning of the trace. 

-a Indicates that the trigger is to be placed in the trace list with <offset> number of 

states after the trigger position to the end of the trace. 

<offset> A decimal value from 0 to 1023. 



If no parameters are supplied, the current trigger position setting is displayed. 
Upon powerup or after tinit, the trigger position is tp s. 

Note that the s, c, and e options are the only position parameters that are valid for 
the optional external analyzer set to timing mode (xtmo -t). 
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See Also tg (defines the trigger expression) 

tl (used to display the trace list) 

tsq (used to specify the trigger position within the trace sequencer; reference the 
sequencer operation when deciding where to position the trigger in the trace list, if 
you want to capture all of the sequence conditions) 

xtmo (specifies whether the external analyzer acts independently or is appended to 
the emulation analyzer) 
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tpat, xtpat - set and display pattern resources 

tpat - display all patterns 

tpat <pattern> - display named patterns 

tpat <pattern> <label>=<value> - equals pattern 
tpat <pattern> <label> ! =<value> - not equals pattern 
tpat <pattern> <label>=<value> and <label>=<value> 
tpat <pattern> <label> ! =<value> or <label> ! =<value> 

xtpat - display all patterns 

xtpat <pattern> - display named patterns 

xtpat <pattern> <label>=<value> - equals pattern 
xtpat <pattern> <label> ! =<value> - not equals pattern 
xtpat <pattern> <label>=<value> and <label>=<value> 
xtpat <pattern> <label> ! =<value> or <label> ! =<value> 



<pattern> 

<label> 

<value> 



The tpat (xtpat) command allows you to assign pattern names to simple emulation 
(external) analyzer expressions. These pattern names are then used in building 
complex expressions for other analyzer commands. 

The tpat command is only valid in the complex analyzer configuration (tcf -c). 

The parameters are as follows: 

One of the pattern names pi through p8. 

A trace label that is currently defined via either the tlb or xtlb commands. 

Values are numeric constants, equates, or symbols. Also, values can be the result 
of constants, equates, and symbols combined with operators. Refer to the <value> 
description. 



If no parameters are given, or if the pattern name is given as *, all eight of the 
current pattern assignments are displayed. If one of the pattern names is given, the 
expression assigned to that pattern is displayed. 

Upon entering complex configuration after powerup or a tinit initialization, all 
eight patterns are defined as tpat <pattern> any. 



See Also 



tcf (defines whether the analyzer is in easy configuration or complex configuration; 
the tpat command is only valid in complex configuration) 

telif (specifies a secondary branch qualifier in analyzer complex configuration; tpat 
patterns may be used in qualifier specification) 
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tg (used to specify a simple trigger in either easy configuration or complex 
configuration; tpat patterns may be used in complex configuration trigger 
specification) 

tif (used to specify a primary branch qualifier in either analyzer configuration; tpat 
patterns may be used in complex configuration branch specifications) 

tpq (specifies a trace prestore qualifier; tpat patterns may be used in qualifier 
specification) 

trng (defines a range of values on a set of analyzer input lines; this range may be 
used in conjunction with the patterns defined by tpat in setting up complex analysis 
qualifiers) 

tsq (used to manipulate the trace sequencer) 

tsto (used to define global storage qualifiers in both analyzer configurations; may 
also be used to define storage qualifiers for each sequencer level in complex 
configuration. The patterns defined by tpat may be used in complex configuration 
storage qualifier definition.) 

xtmo (determines whether the external analyzer acts as an independent state or 
timing analyzer or is appended to the emulation analyzer. If appended, the xtpat 
command is no longer valid; tpat defines patterns to be used across both analyzers.) 
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tpq, xtpq - set or display prestore specification 

tpq - display prestore specification 

tpq <expr> - set prestore specification 

xtpq - display prestore specification 

xtpq <expr> - set prestore specification 



The tpq (xtpq) command allows you to specify a prestore qualifier for the 
emulation (external) trace. 

During the trace, the analyzer fills a two stage pipe with states that satisfy the 
prestore qualifier. Each time a trace state is stored into the trace buffer, the prestore 
qualifier is also stored and then cleared. Therefore, up to two prestore events may 
be stored for each normal store event; the prestore events in the trace buffer will 
correspond to the most recent states that satisfied the prestore qualifier immediately 
prior to a store event but following the previous store event. 

The parameters are as follows: 

<expr> State qualifier expression. Refer to the <expr> description in this chapter. 



If no parameters are given, the current prestore qualifier setting is displayed. Upon 
powerup or after tinit initialization, the prestore qualifier defaults to tpq none. 

See Also tcf (specifies whether the analyzer is to operate in easy configuration or complex 

configuration) 

tsq (used to manipulate the trace sequencer) 

tsto (used to specify a global storage qualifier for both easy configuration and 
complex configuration; also used to specify individual sequence term storage 
qualifiers in complex configuration) 

xtmo (specifies whether the external analyzer will act as an independent state or 
timing analyzer or whether it will be appended to the emulation analyzer. If 
appended to the emulation analyzer, the xtpq command has no effect; the tpq 
command sets the prestore qualifier for both analyzers.) 
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trng, xtrng - set or display range pattern 



trng - display range 

trng <label>=<value> . . <value> - define range 

xtrng - display range 

xtrng <label>=<value> . . <value> - define range 



The trng (xtrng) command lets you specify a range of acceptable values for an 
emulation (external) trace label. This range may then be used in complex qualifiers 
for the trace specification. The trng (xtrng) command is only available in the 
analyzer's complex configuration (see tcf syntax pages). 

There is no need for a not equals operator in specifying ranges, as the trace 
specification commands which allow "range" as a parameter also accept "not 
range" in the form !r. 

If the optional external analyzer has been appended to the emulation analyzer via 
the xtmo command, the xtrng command is invalid; trng sets a range pattern to be 
used by both analyzers. 

The parameters are as follows: 

<label> A trace label that is currently defined via either the tlb or xtlb commands. 

<value> Values are numeric constants, equates, or symbols. Also, values can be the result 

of constants, equates, and symbols combined with operators. Refer to the <value> 
description. 



If no parameters are supplied, the current range definition is displayed. After 
powerup or tinit initialization, the trng command is set to trng any. (Note that 
trng is not directly available after analyzer initialization; the analyzer is set to easy 
configuration when initialized. You must then switch to complex configuration to 
access trng.) 

Ranges can be specified that encompass more bits than the number of bits defined 
for the specified label. 

Note that the tcf -e (set trace configuration to easy) command also will reset trng. 
In other words, any trng defined when the analyzer was in complex configuration 
is destroyed when the analyzer is set to easy configuration; you cannot return to 
complex configuration and use the old trng. 
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See Also tcf (sets analyzer to complex or easy configuration; analyzer must be in complex 

configuration to utilize the trng command) 

telif (specifies the sequencer secondary branch expression; in complex 
configuration, this expression can include references to the range) 

tg (specifies analyzer trigger; may trigger on references to range) 

tif (specifies the sequencer primary branch expression; in complex configuration, 
branch expression may include range qualifier) 

tpat (trace pattern definition; assigns pattern names to simple expressions for later 
use in analyzer specifications, tpat essentially commits only one pattern to a label; 
whereas trng allows a range of values to be assigned to the range pattern) 

tpq (defines trace prestore qualifier; the range specification may be used in 
complex configuration prestore qualifier expressions) 

tsq (trace sequencer definition) 

tsto (defines trace storage qualifier; that is, specifies exactly what states are actually 
to be stored by the analyzer. In complex configuration, this can include states that 
fall within the specification defined by trng) 

xtmo (specifies the mode of the external analyzer; either an independent state or 
timing analyzer or an analyzer appended to the emulation analyzer) 
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ts, xts - display status of emulation trace 

ts - display complete emulation trace status 

ts -w - display short status 

xts - display complete emulation trace status 

xts -w - display short status 

The ts (xts) command allows you to determine the current status of the emulation 
(external) analyzer. 

The parameters are as follows: 

-W The -w option indicates that the trace status should be printed in whisper mode; this 

gives an abbreviated version of the status. See "Whisper Mode Trace Display" 
below for interpretation of the whisper status information. 

Trace Status Displays 

The emulation and external state trace status is displayed in the following form: 

[Emulation | External] Trace Status 

(NEW) [User | CMB ] trace [complete I halted I running ] 
Arm [ ignored I (not) received ] 
Trigger (not) found 
Arm to trigger armcount 
States visible (history) first.. last 
Sequence term term 
Count remaining count 

The external timing trace status is displayed in the following form: 

External Timing Trace Status 

(NEW) [User | CMB ] trace [complete I halted I running ] 
Arm [ ignored I (not) received ] 
trace status 
Arm to trigger armcount 
Samples visible (history) first.. last 

The trace status header indicates whether this status is for the emulation or external 
state trace. 

Whether the trace status is displayed as Emulation or External depends on: 
• Presence of the optional external analyzer. 
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• Whether you entered the ts (emulation trace status) or xts (external trace 
status) command. 

• The current mode setting of the optional external analyzer. If set as a state 
analyzer (xtmo -s), you can have an external state trace status. If set as a 
timing analyzer (xtmo -t), there is a different display for timing status 
(described below). If appended to the emulation analyzer, the xts command is 
invalid; the external analyzer acts as an extension to the emulation analyzer 
and their status is reported under the Emulation Trace Status. 



Status Display Interpretation 



NEW 



User 
CMB 

complete 

halted 

running 



ignored 
received 
not received 



The first line of the trace status indicates the initiator of the trace, whether the trace 
is completed, running, or halted, and whether or not this trace has been displayed. 

This trace has not been displayed. The tl (xtl) command will clear this flag until 
the next trace is started. Halting a trace that is running (as opposed to complete), 
marks the trace as being NEW even though the trace may have been displayed 
while running. The next tl command with no options will list the trace from the top. 

The operator initiated this trace with the t (xt) command. 

This trace was initiated by a /EXECUTE pulse on the CMB after a tx command 
was entered. 

The trace has found its trigger and completed. 

The trace was halted in response to a th (xth) command. 

The trace is still running; either the complete sequencer specifications have not yet 
been satisfied; or not enough qualified store states have been found to fill trace 
memory. 

The second line of the trace display indicates the analyzer arm status. 
The arm condition specified for this trace was tarm always. 
The arm condition has been satisfied. 

The arm condition was not satisfied. (If you specified an arm condition but didn't 
use it in trigger qualification, this will be displayed if the arm condition is not 
satisfied. However, the analyzer may still find the correct trigger and complete the 
trace.) 
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The third line of the state trace display indicates the trigger status. Because of the 
pipelined analyzer architecture, it is possible that the trace status may display "not 
found" when in fact the trigger has been found. This will occur when not enough 
states satisfying the storage specification are found to push the trigger out of the 
pipeline and into trace memory. In any case, the trace will not be displayable until 
the trigger is in trace memory (unless you halt the analyzer). 

The trigger condition has been found. 

The trigger condition has not yet been satisfied. 

For the external timing status, the third line indicates the timing trace status. This 
will be one of the following strings: 

Tracepoint found 
Trigger found - delaying 
Pattern found - waiting for edge 
Prestore complete - waiting for trigger 
Waiting for prestore 
Waiting for arm 

The fourth line of the trace display indicates the amount of time that passed 
between the arm signal and the trigger condition. 

This will be from -0.04 microseconds to 41.943 milliseconds. The arm to trigger 
counter may underflow or overflow, in which case "<-0.04 microseconds" or 
">4 1.943 milliseconds" are reported, respectively. If the arm signal was ignored or 
if the trigger was not found, the character "?" (unknown) is displayed. 

The fifth line of the trace display indicates the number of states displayable by tl. 
(Number of samples in the case of the external timing trace.) 

Number of states which can be displayed by tl (xtl); this will be a number from 0 to 
1024 (or 0 to 512 if tcq is active). 

Number of states which can be displayed if the current trace is halted; this may 
include history states which may be overwritten and thus unavailable if the current 
trace runs to completion. 
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Number of the first state stored in trace memory, relative to the trigger state. This 
will be a number from -1024 to 0. The character "?" is displayed if the trigger state 
is not yet in memory. 

Number of the last state stored in trace memory, relative to the trigger state. This 
will be a number from -1 to 1023. The character ? is displayed if the trigger state is 
not yet in memory. 

The sixth line of the trace display indicates the current sequencer term position. 
(Not used in the external timing trace status.) 

Current sequence term position (1 through 5 in easy configuration; 1 through 8 in 
complex configuration). If the trace is completed or halted, the last sequence term 
number is displayed. A "?" is displayed if the trace is running and the sequencer is 
running too quickly for the current term number to be read. 

The seventh line of the trace display indicates the count qualifier status for the 
primary branch condition of the current sequence term, see tif for further details. 
(Not used in the external timing trace status.) 

count Remaining number of occurrences of the primary branch qualifier needed to satisfy 

the qualifier so that the primary branch will be taken. A "?" is displayed if the trace 
is running and the counter is updating too quickly to be read. 

Whisper Mode Trace Display 

If the -w option is given, an abbreviated version of the trace status is given as 
follows: 

Trace run status: 

R - trace running 

C - trace completed 

H - trace halted 
Trace arm status: 

A - Arm has been received 

a - arm has not yet been received 

x - arm signal is being ignored 
Trace trigger status: 

T - trace trigger has been found 

t - trace trigger has not yet been found 



first 



last 



term 
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Trace list status: 

* - indicates that this trace has not been displayed 

See Also es (allows you to determine general emulator status) 

t (starts an emulation trace) 

tarm (arm the analyzer based on state of the trigl and trig2 signals) 
tg (specify the analyzer trigger state) 
th (halt the current trace in process) 

tif (specify sequencer primary branch condition and number of occurrences) 
tx (specify that trace is to begin upon receiving the CMB /EXECUTE pulse) 
x (begin a synchronous CMB execution) 
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tsck, xtsck - set or display slave clock 
specification for the analyzer 



tsck 


-o 


<pod 


number> 






- turn slave clock off in pod 


tsck 


-d 


<pod 


number> 


-r 


<clock> 


- demux pod, rising edge of clock (s) 


tsck 


-d 


<pod 


number> 


-f 


<clock> 


- demux pod, falling edge of clock (s) 


tsck 


-d 


<pod 


number> 


-x 


<clock> 


- demux pod, both 


edges of clock (s) 


tsck 


-m 


<pod 


number> 


-r 


<clock> 


- mix pod clocks, 
clock ( s ) 


rising edge of 


tsck 


-m 


<pod 


number> 


-f 


<clock> 


- mix pod clocks, 
clock (s) 


falling edge of 


tsck 


-m 


<pod 


number> 


-x 


<clock> 


- mix pod clocks, 
clock (s) 


both edges of 



xtsck 


-o 






- turn slave clock off in external pod 


xtsck 


-d 


-r 


<clock> 


- demux pod, rising edge of clock (s) 


xtsck 


-d 


-f 


<clock> 


- demux pod, falling edge of clock (s) 


xtsck 


-d 


-x 


<clock> 


- demux pod, both edges of clock (s) 


xtsck 


-m 


-r 


<clock> 


- mix pod clocks, rising edge of clock(s) 


xtsck 


-m 


-f 


<clock> 


- mix pod clocks, falling edge of clock (s) 


xtsck 


-m 


-x 


<clock> 


- mix pod clocks, both edges of clock (s) 



The tsck (xtsck) command allows you to specify the slave clock edges used for the 
emulation (external) analyzer trace. 

Each analyzer pod has the capability of latching certain signals with a slave clock 
instead of the master clock. (You set up the master clock with the tck command.) 

The xtsck command controls the slave clock for the optional external analyzer. No 
pod number is necessary since the external analyzer has only one pod. 

The parameters are as follows: 

<pod number> Specifies one of 4 groups of analyzer input lines. These are as follows: 



Pod # Bits 

1 0-15 

2 16-31 

3 32-47 

4 0-15 of the external analyzer 
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Note that you only need to specify pod 4 if you are using the tsck command to 
operate on the optional external analyzer. You would typically do this only if you 
had logically joined the analyzers using the xtmo command. 

-d Specifies that the slave clock operates in demultiplexed mode. In this mode, the 

lower 8 channels of the analyzer pod (bits 0-7) are latched with the slave clock and 
the upper 8 channels (bits 8 through 15) are replaced with the lower 8 channels. In 
other words, the upper 8 bits are identical to the lower 8 at the pod. 

However, the data is not clocked into the analyzer itself until the next master clock 
occurs. Therefore, if no slave clocks have occurred since the last master clock, the 
data on the lower 8 analyzer lines is identical to the upper 8. If one or more slave 
clocks have occurred since the last master clock, the data on the lower 8 bits is the 
only data available to the analyzer. 

When using the -d option, you must specify one of the -r, -f, or -x options to 
indicate the active edge(s) of the slave clock. 

-m Specifies that the slave clock operates in mixed mode. In the mixed mode, the 

lower 8 channels of the analyzer pod (bits 0-7) are latched with the slave clock, and 
the master clock latches in the entire pod. Therefore, if no slave clock has occurred 
since the last master clock, the data on the lower 8 bits of the pod will be clocked 
into the analyzer at the same time as the upper 8 bits. If more than one slave clocks 
has occurred since the last master clock, only the first slave clock data will be 
available to the analyzer. 

When using the -m option, you must specify one of the -r, -f, or -x options to 
indicate the active edge(s) of the slave clock. 



-r Indicates that the pod should latch data on the rising edge of the slave clock, 

-f Indicates that the pod should latch data on the falling edge of the slave clock. 

-X Indicates that the pod should latch data on both edges of the slave clock. 

<clock> Five clock signals are defined: J, K, L, M, and N. 



The L, M, and N clocks are generated by the emulator. The L clock is the 
emulation clock derived by the emulator, the N clock is used as a qualifier to 
provide the user/background tracing options (-u and -b) to tck, and the M clock is 
not used. The L and N clocks may also be used to clock and qualify the external 
analyzer as well as the emulation analyzer. 

The J and K clocks are the clock inputs on the external trace probe (if one is 
present). These clock signals should only be used to clock the external trace; they 
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should not be used to clock the emulation trace although it may occasionally be 
useful to use the external clock signals as qualifiers for the emulation trace. 

-0 If you specify -o with a <pod number>, the slave clock is ignored on that pod. 

Remember that you don't need to specify <pod number> with the xtsck command; 
this command operates only on the single external analyzer pod. 



If no parameters are specified, the current slave clock definitions are displayed. 
The default for all slave clocks is off after powerup or tinit initialization. 

See Also ta (allows you to display active signals on the analyzer input lines; useful in 

verifying that you have selected the correct clock conditions) 

tck (used to define master clock signals used by the analyzer; tsck defines the slave 
clock signals. Default mode for tsck is off on all pods.) 

xtv (specifies threshold voltages for external analyzer input lines; must be set 
correctly to ensure that the J and K clock signals are recognized) 

xtmo (specifies mode of operation for the external analyzer; that is, whether it acts 
as an independent analyzer or is appended to the emulation analyzer) 
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tsq, xtsq - modify or display sequence 
specification 

In the easy configuration: 

tsq - display entire sequence specification 

tsq -r - reset the sequence specification 

tsq -i X - insert sequence term X into sequence 

tsq -d X - delete sequence term X from sequence 

xtsq - display entire sequence specification 

xtsq -r - reset the sequence specification 

xtsq -i X - insert sequence term X into sequence 

xtsq -d X - delete sequence term X from sequence 



In the complex configuration: 



tsq - display entire sequence specification 

tsq -t - display sequence trigger specification 

tsq -t X - set the sequence to trigger on entrance to term X 

tsq -r - reset the sequence specification 



xtsq 

xtsq -t 

xtsq -t X 

xtsq -r 



display entire sequence specification 

display sequence trigger specification 

set the sequence to trigger on entrance to term X 

reset the sequence specification 



The tsq (xtsq) command allows you to manipulate or display the emulation 
(external) trace sequencer. 

When the analyzer is in easy configuration (tcf -e), the sequencer has a maximum 
of four sequence terms with a minimum of one term. 

If the analyzer is in complex configuration (tcf -c), the sequencer always has eight 
terms (although the particular sequencer setup may mean that only two are ever 
accessed). 

The parameters are as follows: 

-r Resets the sequencer. 

In the easy configuration, the result is a simple one term sequence which stores all 
states and triggers on the first occurrence of any state. This is equivalent to issuing 
the commands: 

In the complex configuration, the result is an eight term sequence with the trigger 
term at term number 2. The sequencer will be set to tsto any (store any state). All 
secondary branch qualifiers are turned off (telif X never), and all primary branch 
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qualifiers will jump to the next higher numbered term on any state (tif X any 
(X+1)). 

-i Inserts a new sequence term at X. The new sequence term will use the default 

storage qualifier (which can be modified with the tsto command). It will also use 
the secondary branch qualifier (global restart in easy configuration) specified by the 
telif command. 

If there is already a sequence term with number X, terms with number X and above 
will be renumbered (X becomes X+1) to make room for the new term. 

You must insert terms in a contiguous manner; for example, you cannot insert a 
term number 4 if the sequencer only has two terms defined. Instead, you must next 
insert a term numbered 1, 2 or 3. 

The primary branch qualifier for the new term will be defined as tif X any unless it 
is the last term in the sequence (by definition, the trigger term), in which case the 
primary branch qualifier is set to tif X never. 

-d Deletes the term specified and renumbers higher numbered terms downward to fill 

the gap. 

X Specifies a sequence term number. 

In the easy configuration, X is in the range from 1 through 4 when inserting or 
deleting terms. 

In the complex configuration, X is in the range 2 through 8 to use as the trigger 
term. 

-t Specifies the trigger term when a sequence term number is included. When no 

sequence term number is included, the trigger term is displayed. The analyzer 
triggers on a sequencer branch to the trigger term. 



If no options are given, all of the sequencer storage and branch qualifiers are 
displayed along with the trigger term position. Upon powerup or after tinit 
initialization, the sequencer defaults to the following state: 

tif 1 any 
tsto all 
telif never 



In other words, the sequencer powers up with two sequence terms; the second 
sequence term is the trigger term. Any state will cause a branch from the first term 
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to the second term; global restart is set to never and all states are stored by the 
analyzer. 

Switching analyzer configurations from easy to complex or vice versa also resets 
the sequencer (that is, tcf -c or tcf -e). 

See Also tcf (defines whether analyzer is operated in complex configuration or easy 

configuration) 

telif (sets global restart qualifier in easy configuration; secondary branch qualifier 
in complex configuration) 

tg (defines the trigger qualifier) 

tif (sets the primary branch qualifier in both easy and complex configuration) 
tsto (defines the analyzer global storage qualifier) 
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tsto, xtsto - set or display trace storage 
specification 

In the easy configuration: 

tsto - display storage specification 

tsto <expr> - define storage specification 

xtsto - display storage specification 

xtsto <expr> - define storage specification 



In the complex configuration: 

tsto - display all storage specifications 

tsto X - display storage qualifier X specification 

tsto <expr> - define global storage specification 

tsto X <expr> - define storage qualifier X specification 

xtsto - display all storage specifications 

xtsto X - display storage qualifier X specification 

xtsto <expr> - define global storage specification 

xtsto X <expr> - define storage qualifier X specification 



The tsto (xtsto) command allows you to specify a trace storage qualifier for the 
emulation (external) analyzers. The expression parameter qualifies the states to be 
stored by the analyzer. 

The parameters are as follows: 

<expr> State qualifier expression. Refer to the <expr> description in this chapter. 

X Specifies the sequence term number whose storage qualifier is either displayed or 

assigned as <expr>. 



If no parameters are given, the current trace storage qualifier settings are displayed. 
Upon powerup or after tinit initialization, the trace storage qualifier defaults to tsto 
all. Using the tcf command to switch from complex configuration to easy 
configuration or vice versa will also reset the storage qualifier to tsto all. 

If the analyzer is in easy configuration (tcf -e), the expression is specified by 
<expr> and this serves as a global storage qualifier. In other words, the same 
expression is used as a storage qualifier regardless of the current sequencer state. 

If the analyzer is in complex configuration (tcf -c), the expression is specified by 
<expr> and may be assigned to a sequencer state with the X parameter. When an 
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expression is assigned to a specific term number, the analyzer will only store states 
corresponding to the given expression when at the given sequencer level. If no 
sequence term number is used, the associated expression is defined as global; the 
analyzer stores states satisfying the expression regardless of the sequencer level. 

See Also tcf (used to specify whether the analyzer is in easy configuration or complex 

configuration) 

telif (used to specify a global restart qualifier in easy configuration; specifies a 
secondary branch qualifier for each sequencer level in complex configuration) 

tg (used to specify a trigger condition in either easy configuration or complex 
configuration; overrides the current sequencer specification. Note that tg does not 
affect tsto; therefore, the current tsto specifications remain in effect whenever a tg 
command is entered) 

tif (used to specify a primary branch qualifier in either analyzer configuration) 

tpat (used to assign pattern names to simple analyzer expressions for use in 
constructing complex analyzer expressions; these expressions can be used in 
specifying storage qualifiers for the tsto command) 

trng (used to specify a range of values of a set of analyzer inputs; this range 
information can be used in constructing complex configuration qualifiers for the 
tsto command) 

tsq (used to manipulate the trace sequencer) 
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tx, xtx - enable/disable execute condition 

tx -e - start a measurement when the execute signal is received 
tx -d - ignore the execute signal 

xtx -e - start a measurement when the execute signal is received 
xtx -d - ignore the execute signal 

The tx command allows you to specify that the analyzer will begin a measurement 
when the CMB /EXECUTE line is asserted. 

The parameters are as follows: 

-e Specifies that the analyzer will start a measurement upon receiving the CMB 

/EXECUTE signal. 

-d The analyzer will NOT start a measurement upon receiving the CMB /EXECUTE 

signal. 



If no options are specified, the current state of tx enable/disable is displayed. Upon 
powerup or after a tinit, the system defaults to tx -d. 

If tx -e is given, enabling measurement on execute, the CMB trigger is immediately 
driven true upon receiving the /EXECUTE signal. If the analyzer is not driving 
either trigl or trig2, it is then started. The CMB trigger is then disabled and the 
HP 64700 waits for all other participants in the measurement to release the CMB 
trigger. When the last instrument releases the CMB trigger, the trigger will go 
false; at this point any analyzers driving trigl or trig2 will be started. 

See Also cmbt (specifies whether the CMB trigger signal is driven or received by the 

internal trigl and trig2 signals) 

tarm (specifies the arm condition for the analyzer) 

tg (specifies a trigger condition for the analyzer) 
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<value> - values in Terminal Interface commands 

Values are numeric constants, equates, or symbols. Also, values can be the result 
of constants, equates, and symbols combined with operators. Equates are defined 
with the equ command. Symbols can be loaded with the load command or defined 
with the sym command. 



Constants 

A value may be specified as a constant in any of the following number bases. 
(Constants with no base specified are assumed to be hexadecimal numbers.) 

• Hexadecimal (base H or h). For example: 6eh, 9xH, 0f3, or Ocfh. (The 
leading digit of a hexadecimal constant must be 0-9.) 

• Decimal (base T or t, for base "ten"). For example: 27t or 99T. (Don't cares 
are not allowed in decimal numbers.) 

• Binary (base Y or y). For example: llOly, 01011 Y, or OxxlOxxlly. (The 
leading digit of a binary constant must be 0 or 1 . Do not use the characters "B" 
or "b" to specify the base of binary numbers because they will be interpreted as 
hexadecimal numbers; for example, IB equals 27 decimal.) 

• Octal (base Q, q, O, or o). For example: 777o, 6432q, or 7xx3Q. (The leading 
digit of an octal constant must be 0-7.) 

Don't cares are not allowed in ranges or decimal numbers. A value of all don't 
cares may be represented by a question mark (?). 



Operators. When specifying values, constants can be combined with the 
following operators (in descending order of precedence): 



-, ~ Unary two's complement, unary one's complement. The 

unary two's complement operator is not allowed on 
constants containing don't care bits. 

*, /, % Integer multiply, divide, and modulo. These operators are 

not allowed on constants containing don't care bits. 

+, - Addition, subtraction. These are not allowed on constants 

containing don't care bits. 
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«, <«, Shift left, rotate left, shift right, rotate right. 

», »> 

& Bitwise AND. 

A Bitwise exclusive or, XOR. 

I Bitwise inclusive OR. 

&& Logical AND/bit-wise merge. When bits are different, the 

first value overrides the second; e.g., lOxxy && llxly == 
lOxly. 

Note that all operations are carried out on 32-bit numbers. 
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ver - display system software and hardware 
version numbers 

ver 

The ver command instructs the emulator to return the current emulator Terminal 
Interface software version numbers. 
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w - wait for specified condition before continuing 

w - wait for any keystroke 

w <value> - wait for <value> number of seconds or any keystroke 
w -m - wait for measurement complete or any keystroke 

The w command is used to program automatic waits into macros, repeats, and 
command files. Normal operation is to wait for any keystroke before executing the 
next operation; optionally, the wait can be programmed for a specific time period or 
for completion of a measurement in process (such as a trace). 

The parameters are as follows: 

<value> The number of seconds before proceeding. 

-m Wait for completion of the current measurement before proceeding. 



Examples To cause the emulator to wait for any keystroke before proceeding to the next 

command, type: 

U>w 

You might use this in a situation where you wish the operator to make a judgment 
regarding some other condition before proceeding with the next measurement. 

To cause the emulator to wait for 32 seconds or for any keystroke, type: 

U> w 32 

This might be used where you know the desired system state will be reached in a 
definite amount of time (or should be reached within that time). 

To have the emulator wait until another measurement is completed or for any 
keystroke entry, type: 

U> w -m 

Note that the above examples, taken exactly as shown, don't provide you with a 
useful function - they are provided only to show correct examples of command 
line syntax. To use the wait command effectively, it should be applied within 
macros, repeat commands, or command files. Refer to the rep and mac commands 
for further examples. 
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x - emit a Coordinated Measurement Bus execute 
signal 

X 

The x command allows you to initiate a synchronous CMB (Coordinated 
Measurement Bus) measurement execution. 

When x is performed, the CMB /EXECUTE line is pulsed. If tx (trace at execute) 
is enabled, an analyzer measurement will begin. If the CMB is enabled via the cmb 
-e command, a break will occur, followed by a run at execute as specified by the rx 
command. 

The x command is available whether CMB and trace at execute are enabled or not. 
Specifically, the cmb and tx commands control how this HP 64700 emulator will 
respond when an /EXECUTE or READY is detected. The x command only 
controls when this emulator will issue an /EXECUTE signal. 



See Also cmb (used to enable or disable interaction with the CMB) 

rx (used to specify an address to start a program run when the /EXECUTE pulse is 
received from the CMB) 

tx (used to specify that an analyzer measurement should begin when the 
/EXECUTE pulse is received from the CMB) 
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xteq - set/display external timing edge qualifier 

xteq - display current channels which will cause 

a trigger on a rising or falling edge 
xteq -f <rangelist> - set falling edge channels to <rangelist> 
xteq -r <rangelist> - set rising edge channels to <rangelist> 
xteq -f <unarypat> - set falling edge channels to <unarypat> 
xteq -r <unarypat> - set rising edge channels to <unarypat> 
xteq -r <rangelist> -f <unarypat> - multiple arguments accepted 



The xteq command allows you to specify the channels which will cause an edge 
trigger. 

The trigger will occur following a valid duration of a pattern specified by xtt when 
a transition occurs on any of the lines specified in xteq. Note that xteq allows you 
to qualify the transitions to trigger only on the rising edge or the falling edge of the 
given input lines. 

Note that the timing trace information is only accessible through the binary trace 
list option (tl -b). 

The parameters are as follows: 

-r The trigger will occur on the rising edge of any signal on the input lines specified. 

-f The trigger will occur on the falling edge of any signal on the input lines specified. 

<unarypat> Valid unary pattern values are: 

all Set qualifier to all 16 channels, 

any 

none Set qualifier to 0 channels, 

never 

<rangelist> This parameter can be one or more of the following range arguments: 

<num> Channel identifier (0 to 16). This specifies the bit which will 

cause an edge trigger. 

<num>..<num> Channel range (0 to 16). This specifies the range of bits which 
will cause an edge trigger. 
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<label> Use full range of <label>. All of the bits assigned to the label 

will cause an edge trigger. Refer to the tlb, xtlb description for 
information on defining labels. 

<label>:<num> Use <num> as offset into <label>. 
<label>:<num>..<num> 

Specifies a subrange of <label>. This specifies the bits to be 
used within that label which will cause an edge trigger. 

Note that when specifying a range of bits to use within a label, 
the bit range specified is relative to the label, not to the input 
bit. For example, if you define a label named STATUS with 
input bits 8.. 11, then want to specify the least significant two 
bits of STATUS in a trigger specification, you can use either 
STATUS:0..1 or simply the range 8..9. 



If no parameters are specified, the current edge qualifier is displayed. Upon 
powerup or tinit initialization, the default setting is xteq -r any -f any. 

When multiple arguments are used, the combinations are ORed together to form a 
single pattern. 

See Also tlb,xtlb (specifies labels assigned to input lines for the emulation (external) 

analyzer) 

xtgq (specifies an glitch qualifier used in conjunction with xtt to determine a valid 
trigger state) 

xtm (specifies timing analyzer mode) 

xtt (specifies timing analyzer trigger pattern and duration) 
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xtgq - set/display external timing glitch qualifier 

xtgq - display current channels which will 

cause a glitch trigger 
xtgq <rangelist> - set glitch channels to <rangelist> 
xtgq <unarypat> - set glitch channels to <unarypat> 



<unarypat> 



<rangelist> 



The xtgq command allows you to specify the channels which will cause a glitch 
trigger. 

A glitch trigger will occur following a valid duration of a pattern as specified in the 
xtt command while the pattern is still present. A less than duration specified in xtt, 
or a timing mode other than xtm -g will cause the xtgq command to be ignored. 

You might use this command to look for glitch occurrences related to a specific bit 
pattern. 

Note that the timing information is only accessible through the binary trace list 
option (tl -b). 

The parameters are as follows: 
Valid unary pattern values are: 

Set qualifier to all 16 channels. 



all 

any 

none 
never 



Set qualifier to 0 channels. 



This parameter can be one or more of the following range arguments: 

<num> Channel identifier (0 to 16). This specifies the bit which will 

cause a glitch trigger. 



<num>..<num> 



<label> 



Channel range (0 to 16). This specifies the range of bits which 
will cause a glitch trigger. 

Use full range of <label>. All of the bits assigned to the label 
will cause a glitch trigger. Refer to the tlb, xtlb description for 
information on defining labels. 



<label>:<num> Use <num> as offset into <label>. 
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<label>:<num>..<num> 

Specifies a subrange of <label>. This specifies the bits to be 
used within that label which will cause a glitch trigger. 

Note that when specifying a range of bits to use within a label, 
the bit range specified is relative to the label, not to the input 
bit. For example, if you define a label named STATUS with 
input bits 8.. 11, then want to specify the least significant two 
bits of STATUS in a trigger specification, you can use either 
STATUS:0..1 or simply the range 8..9. 



If no parameters are specified, the current glitch qualifier is displayed. Upon 
powerup or tinit initialization, the default setting is xtgq none. 

When multiple arguments are used, the combinations are ORed together to form a 
single pattern. 

See Also tlb,xtlb (specifies labels assigned to input lines for the emulation (external) 

analyzer) 

xteq (specifies an edge qualifier used in conjunction with xtt to determine a valid 
trigger state) 

xtm (specifies timing analyzer mode; must be in mode xtm -g for xtgq use) 
xtt (specifies timing analyzer trigger pattern and duration) 
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xtm - set/display external timing mode 



xtm - display current timing mode 

xtm -s - turn on standard timing mode 

xtm -g - turn on glitch timing mode 

xtm -t - turn on transitional timing mode 



The xtm command allows you to specify the mode of operation for the timing 
analyzer. 

This command is only available if the HP 64700 emulator is equipped with the 
external state/timing analyzer option. 

The parameters are as follows: 

-S Selects the standard timing analyzer mode and samples data at the period selected 

by xtsp; up to 1024 samples can be stored during a single trace. 

-g The timing analyzer operates in standard mode with glitch detection added. Again, 

the sample rate is selected by xtsp. When glitch mode is selected, the maximum 
number of samples per trace is reduced to 5 12. 

-t Selects the transitional timing analyzer mode. Data is only stored when an input 

transition is detected. For the analyzer to record these transitions accurately, some 
trace memory must be dedicated to storing the delta time between transitions, so the 
number of state transitions that can be stored is reduced to a maximum of 512. 



If no parameters are supplied, the current mode setting for the timing analyzer is 
displayed. Upon powerup or tinit, the timing analyzer mode is set to xtm -t. 

See Also xtmo (specifies whether to use the external analyzer as a separate state analyzer, 

separate timing analyzer, or append the lines to the emulation analyzer) 

xtsp (defines the timing sample period) 
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xtmo - external analyzer trace mode 

xtmo -e - emulation analyzer has external bits 
xtmo -s - external state analyzer 
xtmo -t - external timing analyzer 

The xtmo command allows you to specify the mode of operation for the external 
analyzer. The analyzer can be configured to run as an independent state or timing 
analyzer; or, the external analyzer can be associated with the emulation analyzer to 
synchronize measurements made by the two analyzers. 

The parameters are as follows: 

-S The external analyzer acts as an independent state analyzer. 

-t The external analyzer acts as an independent timing analyzer. 

-e The external analyzer is appended to the emulation analyzer. 



If no parameters are specified, the current operation mode of the external analyzer 
is displayed. Upon powerup, the default operation mode is xtmo -e. 

Note that if the emulation and external analyzers are clocking data off of the same 
clock, the setup/hold times of the data on the external analyzer probe inputs may 
not be met properly. The timing relationship between a target system processor 
signal and the setup/hold time of the external probe signals must be specified for 
each emulator. This is because each emulator has unique circuitry that generates 
the emulation analyzer clock and each processor has different timing requirements 
Therefore, each emulator must specify the setup/hold time requirements of the 
external probe inputs with respect to a target processor signal. 

If the external analyzer has been associated with the internal analyzer with the 
xtmo -e command, and trace specifications have been defined referencing lines 
present on the external analyzer, the analyzer cannot be reconfigured as an 
independent state or timing analyzer with the xtmo -s or xtmo -t commands until 
the trace specifications referencing the external analyzer lines are removed. 

If the external analyzer is in the independent state or timing mode, and an xtmo -e 
command is issued to append it to the emulation analyzer, the trace specifications 
for the external analyzer lines are reinitialized. 
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xtmo - external analyzer trace mode 

See Also bnct (specifies whether trigl and/or trig2 are to be driven or received by the rear 

panel BNC connector) 

cmbt (specifies whether the trigl and/or trig2 signals are to be driven or received 
by the CMB trigger line) 

tarm (specifies the arm condition for the analyzer) 

tgout (specifies whether or not the trigl and/or trig2 signals are to be driven when 
the analyzer finds its trigger) 

tx (specifies that the analyzer is to commence a trace upon receiving the CMB 
execute pulse) 
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xtsp - set/display external timing sample period 

xtsp - display current timing sample period 

xtsp <period> n - set timing sample period to <period> nanoseconds 
xtsp <period> u - set timing sample period to <period> microseconds 
xtsp <period> m - set timing sample period to <period> milliseconds 



The xtsp command allows you to define the sample period for timing analyzer 
measurements. 

Larger sample periods enable coverage of more events; however, there is the 
danger that some transitions may be missed if they change during the sample 
period. Conversely, small sample periods virtually guarantee recording of all 
transitions but allow the measurement of only a small total number of events in 
time. 

The parameters are as follows: 

<period> Defines the sample period for the analyzer. This is an a integer value. 

The valid range for <period> is between 10 ns and 50 ms in a 1,2,5 sequence (that 
is, 10 ns, 20 ns, 50 ns,..., 50 ms) for standard timing modes. 

For glitch mode valid periods are between 20 ns and 50 ms in the same step 
sequence. 

For transitional timing mode, the only valid sample period is 10 ns. 
n Indicates that the given sample period is in nanoseconds. 

U Indicates that the given sample period is in microseconds, 

m Indicates that the given sample period is in milliseconds. 



If no parameters are given, the current setting of the sample period is displayed. 
Upon powerup or tinit initialization, the sample period setting is xtsp 10 n. 

See Also xtm (defines the timing analyzer run mode; if mode is xtm -s or xtm -g, then xtsp 

defines the amount of time between samples; if mode is xtm -t, the timing analyzer 
runs in transitional mode; the sample period (10 nanoseconds only) is used as a 
clock to measure the delta time between transitions) 
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xtt - set/display external timing trigger condition 

xtt - display current timing trigger setting 

xtt <expr> < <period> n - trigger when <expr> is true 

- for less than <period> ns 
xtt <expr> > <period> u - trigger when <expr> is true 

- for greater than <period> us 
xtt <expr> > <period> m - trigger when <expr> is true 

- for greater than <period> ms 



The xtt command lets you specify the timing analyzer trigger. The trigger 
specification includes the trigger pattern and the duration of that pattern. 

If <expr> is found but <period> is not satisfied, there is a 20 ns reset time before 
the analyzer will search for another pattern. 

The parameters are as follows: 

<expr> Defines a simple expression of the general form label=pattern or label=pattern 

and label=pattern .... Also, any, all, none, and never may be used as the 
expression. 

Refer to the tlb, xtlb description for information on defining labels. 

<period> Specifies, in conjunction with the greater than (>) and less than (<) operators, and 

the n, u and m designators, define a duration for which the trigger must be present 
to satisfy the trigger condition. The <period> is always expressed as an integer 
value. 

If > <period> is specified, <period> must fall within the range of 30 ns to 10 ms in 
10 ns increments. The trigger will occur at the end of the specified duration. 

If < <period> is specified, <DURATION> must fall within the range of 40 ns to 10 
ms in 10 ns increments. The pattern must remain stable for at least 20 ns; the 
trigger will occur after the pattern changes states from the designated pattern. 

n Indicates that the duration is specified in nanoseconds. 

U Indicates that the duration is specified in microseconds. 

m Indicates that the duration is specified in milliseconds. 
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If no parameters are specified, the current timing analyzer trigger expression and 
duration are displayed. Upon powerup or tinit initialization, the timing trigger is 
set to xtt any. 

See Also xteq (specifies that certain timing channels will qualify the trace trigger specified 

by xtt; the pattern and duration are specified by xtt, the trigger occurs when the 
signal transition specified by xteq occurs) 

xtgq (specifies a glitch qualifier for xtt; the trigger occurs after the pattern and 
duration specified by xtt is satisfied when the glitch specified by xtgq occurs) 

xtlb (defines labels for external analyzer input lines) 

xtm (sets the timing mode for the analyzer to standard, glitch, or transitional) 
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xttd - set/display external timing trigger delay 

xttd - display current timing trigger delay 

xttd <period> n - set timing trigger delay to <period> nanoseconds 

xttd <period> u - set timing trigger delay to <period> microseconds 

xttd <period> m - set timing trigger delay to <period> milliseconds 

The xttd command allows you to specify the amount of time to delay the timing 
analyzer trigger after a valid trigger condition has occurred. 

The parameters are as follows: 

<period> Specifies, along with the n, u, or m parameters, the trigger delay period for the 

analyzer. This is an a integer value; the valid range for <period> is between 0 and 
10 ms in 10 ns increments. 

n Indicates that the given delay is in nanoseconds. 

U Indicates that the given delay is in microseconds. 

m Indicates that the given delay is in milliseconds. 



If no parameters are given, the current setting of the delay is displayed. Upon 
powerup or tinit initialization, the delay setting is xttd 0. 



See Also xtt (specifies the timing analyzer trigger pattern and duration) 
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<unarypat> 



xttq - set/display external timing transition 
qualifier 

xttq - display current channels which will 

cause a transition in transitional mode 
xttq <rangelist> - set transition channels to <rangelist> 
xttq <unarypat> - set transition channels to <unarypat> 

The xttq command allows you to specify the channels which will cause a transition 
record when the timing analyzer mode is set to transitional (xtm -t). 

The parameters are as follows: 

Valid unary pattern values are: 

all Set qualifier to all 16 channels, 

any 



<rangelist> 



none 
never 



Set qualifier to 0 channels. 



This parameter can be one or more of the following range arguments: 



<num> 



<num>..<num> 



<label> 



Channel identifier (0 to 16). This specifies the bit which will 
cause a timing transition record. 

Channel range (0 to 16). This specifies the range of bits which 
will cause a timing transition record. 

Use full range of <label>. All of the bits assigned to the label 
will cause a timing transition record. Refer to the tlb, xtlb 
description for information on defining labels. 



<label>:<num> Use <num> as offset into <label>. 
<label>:<num>..<num> 



Specifies a subrange of <label>. This specifies the bits to be 
used within that label which will cause a timing transition 
record. 
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Note that when specifying a range of bits to use within a label, 
the bit range specified is relative to the label, not to the input 
bit. For example, if you define a label named STATUS with 
input bits 8.. 11, then want to specify the least significant two 
bits of STATUS in a trigger specification, you can use either 
STATUS:0..1 or simply the range 8..9. 



If no parameters are specified, the current transition qualifier is displayed. Upon 
powerup or tinit initialization, the default setting is xttq any. 

See Also tlb,xtlb (specifies labels assigned to input lines for the emulation (external) 

analyzer) 

xteq (specifies an edge qualifier used in conjunction with xtt to determine a valid 
trigger state) 

xtgq (specifies a glitch qualifier used in conjunction with xtt to determine a valid 
trigger state) 

xtm (specifies timing analyzer mode; must be in mode xtt -t (transitional mode) for 
xttq to be useful) 

xtt (specifies timing analyzer trigger pattern and duration) 
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xtv - threshold voltage for the external analyzer 

xtv - display current threshold voltage 

xtv -l<level> - set lower byte and J clock 

xtv -u<level> - set upper byte and K clock 

xtv -u<level> -l<level> - multiple arguments accepted 



The xtv command allows you to set the logic threshold voltages for the external 
trace probes. 

The parameters are as follows: 

-I Specifies the threshold voltage that is to be used for the lower 8 bits of the analyzer 

probe. These are bits 0 through 7 and the J clock. 

-U Specifies the threshold voltage specified that is to be used for the upper 8 bits of the 



analyzer probe. 


These are bits 8 through 15 and the K clock. 


Specifies the voltage level. Valid options for <level> are: 


ECL 


Voltage levels for ECL logic, -1 .3 volts. 


TTL 


Voltage levels for TTL logic, +1 .4 volts. 


CMOS 


Voltage levels for CMOS logic, +2.5 volts. 


+/-X.XX 


User definable levels -6.40 to +6.35 volts. 



If no parameters are specified, the current threshold voltage settings are printed. 
Upon powerup or tinit initialization, the threshold voltage settings are set to xtv -u 
TTL -1 TTL. 

See Also ta (allows you to view trace input signal activity; useful in verifying the correct 

threshold levels) 
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This chapter contains descriptions of error messages that can occur while using the 
Terminal Interface. The error messages are listed in numerical order, and each 
description includes the cause of the error and the action you should take to remedy 
the situation. 

The emulator can return messages to the display only when it is prompted to do so. 
Situations may occur where an error is generated as the result of some command, 
but the error message is not displayed until the next command (or a carriage return) 
is entered. 

A maximum number of 8 error messages can be displayed at one time. If more 
than 8 errors are generated, only the last 8 are displayed. 
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Emulator Error Messages 

4 Coverage measurement not supported 

Cause: You attempted to use the cov command for an emulator that does not 
provide coverage memory. 

40 Restricted to real time runs 

Cause: While the emulator is restricted to real-time execution, you have attempted 
to use a command that requires a temporary break in execution to the monitor. The 
emulator does not permit the command and issues this error message. 

Action: You must break the emulator's execution into the monitor before you can 
enter the command. 

61 Emulator is in the reset state 

Cause: You have entered a command that requires the emulator to be running in 
the monitor (for example, displaying registers). 

Action: Enter the b (break) command to cause the emulator to run in the monitor, 
and enter the command that caused the error again. 

1 00 No response from monitor 

Cause: The main cause of this error message is when the target system does not 
assert RDY for target memory and I/O accesses. 

Action: Do not attempt to access target locations that don't return RDY. 

1 02 Monitor failure; no clock input 

Cause: The monitor is unable to run because no emulation processor clock is 
available. 

Action: Make sure a clock meeting the microprocessor's specifications is input to 
the clock pin of the target system probe. 
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1 03 Monitor failure; no processor cycles 

Cause: The monitor is unable to run since the processor is not running. The 
monitor is unable to determine the cause of the failure. 

Action: If running in-circuit, troubleshoot the target system. 

1 04 Monitor failure; bus grant 

Cause: The monitor is unable to run. The emulation processor is not running 
because it has granted the bus to another device. 

Action: Wait until the processor has regained bus control, then retry the operation. 

1 05 Monitor failure; halted 

Cause: The monitor is unable to run because the processor is halted (due to an 
external halt line or a halt instruction). 

Action: Release the external halt and retry the operation. If the processor halted 
due to a halt instruction, try the rst command, then retry the operation. 

1 06 Monitor failure; wait state 

Cause: The monitor is unable to run because the processor is in a continuous wait 
state. 

Action: A continuous wait state may indicate target system problems. 
Troubleshoot the wait line. 

1 07 Monitor failure; bus error 

Cause: The monitor is unable to run because the processor has encountered a bus 
fault. 

Action: Determine why the bus error was activated. 
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80186/8/XL/EA/EB/EC Emulator Messages 

The following error messages are unique to the HP 64767 emulator. 

1 40 User code load module too big 

Cause: This error occurs when the size of the user program absolute code is greater 
than 1 Mbyte. 

Action: Modify the user program so that the absolute code generated takes up less 
than 1 Mbyte. 

141 Foreground monitor load module too big 

Cause: This error occurs when the size of the user foreground monitor program 
absolute code is greater than 4 Kbytes. 

Action: Modify the user foreground monitor program so that the absolute code 
generated takes up less than 4 Kbytes. 

1 50 User foreground monitor required 

Cause: This error occurs when the cf mon=ufg command is entered before the user 
foreground monitor code has been loaded with the load -f command. 

Action: Load the user foreground monitor program before configuring the 
emulator for a user foreground monitor. 

1 52 Attempt to map address range occupied by foreground monitor 

Cause: This error occurs when part of the address range in the map command 
overlaps the 4 Kbyte long address range of the foreground monitor program. 

Action: Either change the address range you are trying to map, or relocate the 
foreground monitor program with the cf loc=<addr> command. 

1 53 Second term physically smaller than first term 

Cause: This error occurs when specifying an address range (<addr>..<addr>) and 
the first address is higher than the second address. 
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Action: Make sure the first address is lower than the second address when 
specifying address ranges. 

1 54 Range terms must be same type (physical or logical) 

Cause: This error occurs when specifying an address range (<addr>..<addr>) and 
one address is specified as a logical address (segment:offset) while the other 
address is specified as a physical address. 

Action: Make sure that both addresses in the range are either logical or physical 
addresses. 

1 55 Range terms must be in same segment 

Cause: This error occurs when specifying an address range 
(<segment:offset>..<segment:offset>) and the two segment values are different. 

Action: Make sure the segment values are the same when specifying address 
ranges using logical values. 

1 56 I/O accesses not allowed in dword display mode 

Cause: An io command has been entered while the display mode is set to dword 
(either by a m -dd or mo -dd command). 

Action: Change the display mode by entering a mo -db or mo -dw command. 

1 57 Display and access modes must be the same for I/O 

Cause: An io command has been entered while the display and access modes are 
different (for example, mo -ab -dw or mo -aw -db). 

Action: Make the display modes the same by entering a mo -ab -db or 
mo -aw -dw command. 

1 61 IRET stack conflicts with Peripheral Control Block Location 

Cause: An IRET instruction (which pops the IP, CS, and flag values from the 
stack) is used when running or stepping user code. This error occurs when the 
segment stack pointer points to the Peripheral Control Block. 

Action: Either change the value of the segment stack pointer or relocate the 
Peripheral Control Block. 
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1 93 i80C186/8Ex firmware not compatible with emulation probe 

Cause: This status message indicates that the i80C 1 86/8Ex emulator probe is not 
properly connected to the cable coming from the emulator control card in the 
frame. This renders the emulator completely unuseable. 
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General Emulator and System Messages 

201 Out of system memory 

Cause: Macros and equates that you have defined have used all of the available 
system memory. 

Action: Delete some of the existing macros (mac -d <NAME>) and equates (equ 
-d <NAME>), which will free additional memory. 

204 FATAL SYSTEM SOFTWARE ERROR 

205 FATAL SYSTEM SOFTWARE ERROR 

208 FATAL SYSTEM SOFTWARE ERROR 

Cause: The system has encountered an error from which it cannot recover. 

Action: Write down the sequence of commands which caused the error. Cycle 
power on the emulator and reenter the commands. If the error repeats, call your 
local HP Sales and Service office for assistance. 

206 Incompatible compatibility table entry 

Cause: The emulation firmware (ROM) is not compatible with the analysis or 
system firmware in your HP 64700 system. 

Action: The ROMs in your emulator must be compatible with each other for your 
emulation system to work correctly. Contact your Hewlett-Packard Representative. 

300 Invalid option or operand 

305 Invalid option or operand: %s 

Cause: You have specified incorrect option(s) to a command. %s, if printed, 
indicates the incorrect option(s). 

Action: Reenter the command with the correct syntax. Refer to the on-line help 
information. 
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307 Invalid expression: %s 

Cause: You have entered an expression with incorrect syntax; therefore, it cannot 
be evaluated. %s is the bad expression. 

Action: Reenter the expression, following the syntax rules for that type of 
expression. Refer to the command description to determine the expression type; 
then refer to the expression syntax pages to determine the correct syntax for that 
type. 

308 Invalid number of arguments 

Cause: You have either entered too many options to a command or an insufficient 
number of options. 

Action: Re-enter the command with correct syntax. Refer to the command syntax 
pages in this manual for information. 

31 0 Invalid address: %s 

Cause: You specified an invalid address value as an argument to a command (other 
than an analyzer command). For example, you may have specified digits that don't 
correspond to the base specified, or you forgot to precede a hexadecimal letter digit 
with a number (even zero (0)). 

Action: Re-enter the command and the address specification. See the 
<ADDRESS> and <EXPRESSION> syntax pages in the "Commands" chapter for 
information on address specifications. 

31 1 Invalid address range: %s 

Cause: You specified an invalid address range as an argument to a command (other 
than an analyzer command). For example, you may have specified digits that don't 
correspond to the base specified, or you forgot to precede a hexadecimal letter digit 
with a number, or the upper boundary of the range you specified is less than the 
lower boundary. 

Action: Re-enter the command and the address specification. See the 
<ADDRESS> and <EXPRESSION> syntax pages in the "Commands" chapter for 
information on address specifications. Also, make sure that the upper boundary 
specification is greater than the lower boundary specification (the lower boundary 
must always precede the upper boundary on the command line). 
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312 Ambiguous address: %s 

Cause: Certain emulators support segmentation or function code information in 
addressing. The emulator is unable to determine which of two or more address 
ranges you are referring to, based upon the information you entered. 

Action: Re-enter the command and fully specify the address, including 
segmentation or function code information. 

313 Missing option or operand 

Cause: You have omitted a required option to the command. 

Action: Re-enter the command with the correct syntax. Refer to the "Commands" 
chapter for further information on required syntax. 

314 Option conflict: %s 

Cause: You have entered a command with two options which cannot be used 
together. For example, you might have entered tl -bx; you cannot ask for both a 
binary and hexadecimal trace list dump. 

Action: Reenter the command, specifying only non-conflicting options. Refer to 
the command description to determine which options may be used together. 

315 Invalid count: %s 

Cause: This error occurs when the emulation system expects a certain number (of 
arguments, for example), but you specify a different number. 

Action: Enter the number the system expects to receive. 

316 Invalid range expression: %s 

Cause: In the tl command, you specified an illegal range. For example, you might 
have specified tl -10..a. 

Action: Use only legitimate range numbers in the tl command (-1024.. 1023); the 
second range value must be greater than the first. 



362 



Chapter 10: Error Messages 
General Emulator and System Messages 



317 Range out of bounds: %s 



Cause: In the tl command, you specified a range number which was greater than 
the number of states available in the analyzer. For example, you might have 
specified tl -2048..2048; the analyzer only has 1024 states. 

Action: Specify range numbers between -1024 and 1023. 



318 Count out of bounds: %s 



Cause: You specified an occurrence count less than 1 or greater than 65535 for tg 
or tif. For example, you might have entered tif 1 any 2 69234. 

Action: Re-enter the command, specifying a count value from 1 to 65535. For 
example: tif 1 any 2 65535. 



31 9 Invalid base: %s 



Cause: This error occurs if you have specified an invalid base in the tf or xtf 
commands. 

Action: Enter the help tf or help xtf command to view the valid base options. 



320 Invalid label: %s 



Cause: You tried to define a label with characters other than letters, digits, or 
underscores. 

Action: Re-enter the tlb command with a label consisting only of letters, digits, or 
underscores. 



321 Label not defined: %s 



Cause: You entered an analyzer expression in which the label was not present in 
the analyzer label list. For example, if the label list includes addr, data, and stat, 
you might have entered something such as tg lowerdata=24t. This error also 
occurs if you try to delete a label that does not exist. 

Action: You can re-enter the command, using one of the previously defined labels 
and adjust the expression as necessary to accommodate the fit of that label to the 
analyzer input lines. Or, you can define a new label using the tlb command, then 
re-enter the analyzer command using the newly defined label. 
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400 Record checksum failure 

Cause: During a transfer operation, the checksum specified in a file did not agree 
with that calculated by the HP 64700. 

Action: Retry the transfer operation. If the failure is repeated, make sure that both 
your host and the HP 64700 data communications parameters are configured 
correctly. 

401 Records expected: %s; records received: %s 

Cause: The HP 64700 received a different number of records than it expected to 
receive during a transfer operation. 

Action: Retry the transfer. If the failure is repeated, make sure that the data 
communications parameters are set correctly on the host and on the HP 64700. 
Refer to the "Installation" chapter for details. 

41 0 File transfer aborted 

Cause: A transfer operation was aborted due to a break received, most likely a 
<CTRL>c from the keyboard. 

Action: If you typed <CTRL>c, you probably did so because you thought the 
transfer was about to fail. Retry the transfer, making sure to use the correct 
command options. If you are unsuccessful, make sure that the data 
communications parameters are set correctly on the host and on the HP 64700, then 
retry the operation. 

41 1 Severe error detected, file transfer failed 

Cause: An unrecoverable error occurred during a transfer operation. 

Action: Retry the transfer. If it fails again, make sure that the data 
communications parameters are set correctly on the host and on the HP 64700. 
Also make sure that you are using the correct command options, both on the 
HP 64700 and on the host. 

41 2 Retry limit exceeded, transfer failed 

Cause: The limit for repeated attempts to send a record during a transfer operation 
was exceeded, therefore the transfer was aborted. 
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Action: Retry the transfer. Make sure you are using the correct command options 
for both the host and the HP 64700. The data communications parameters need to 
be set correctly for both devices. Also, if you are in a remote location from the 
host, it is possible that line noise may cause the failure. 

413 Transfer failed to start 

Cause: Communication link or transfer protocol incorrect. 
Action: Check link and transfer options. 

415 Timeout, receiver failed to respond 

Cause: Communication link or transfer protocol incorrect. 
Action: Check link and transfer options. 

420 Unknown mode: %s 

Cause: This error occurs when you have specified an unknown option in the stty 
command. 

Action: Enter the help stty command to view the valid options. 

425 Load option conflict: %s and option: %s 

Cause: Two or more options in the load command cannot be used together. 

Action: Enter the help load command to view the options that cannot be used 
together. 

520 Equate not defined: %s 

Cause: You tried to delete an equate that did not exist in the equate table. For 
example suppose the equates a=l and b=2 were in the equate table. If you typed 
equ -d c, you would receive the above error message. 

Action: Use equ to display the list of named equates before deleting equates. 

600 Adjust PC failed during break 

Cause: System failure or target condition. 

Action: Run performance verification (pv command), and check target system. 
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602 Break failed 

Cause: The b command was unable to break the emulator to the monitor. 

Action: Determine why the break failed, then correct the condition and retry the 
command. See message 608. 

603 Read PC failed during break 

Cause: System failure or target condition. 
Action: Try again. 

604 Disable breakpoint failed: %s 

Cause: System failure or target condition. 

Action: Run performance verification (pv command), and check target system. 

605 Undefined software breakpoint: %s 

Cause: The emulator has encountered a software breakpoint in your program that 
was not inserted with the bp command. 

Action: If your processor allows different software breakpoint instructions, either 
modify the ones you inserted in your code, or modify the ones inserted by bp using 
your emulator's configuration options (cf command). If only one instruction is 
available, remove those inserted in your code before assembly and link, then 
reinsert them using the bp command. 

606 Unable to run after CMB break 

Cause: System failure or target condition. 

Action: Run performance verification (pv command), and check target system. 

608 Unable to break 

Cause: This message is displayed if the emulator is unable to break to the monitor 
because the emulation processor is reset, halted, or is otherwise disabled. 

Action: First, look at the emulation prompt and other status messages displayed to 
determine why the processor is stopped. If reset by the emulation controller, use 
the b command to break to the monitor. If reset by the emulation system, release 
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that reset. If halted, try rst -m to get to the monitor. If there is a bus grant, wait for 
the requesting device to release the bus before retrying the command. If there is no 
clock input, perhaps your target system is faulty. It's also possible that you have 
configured the emulator to restrict to real time runs, which will prohibit temporary 
breaks to the monitor. 



61 0 Unable to run 

Cause: System failure or target condition. 

Action: Run performance verification (pv command), and check target system. 

61 1 Break caused by CMB not ready 

Cause: This status message is printed during coordinated measurements if the 
CMB READY line goes false. The emulator breaks to the monitor. When CMB 
READY is false, it indicates that one or more of the instruments participating in the 
measurement is running in the monitor. 

Action: None, information only. 

61 2 Write to ROM break 

Cause: This status message will be printed if you have set be -e rom and the 
emulation processor attempted a write to a memory location mapped as ROM. 

Action: None (except troubleshooting your program). 

61 3 Analyzer Break 

Cause: Status message. 
Action: None. 

61 4 Guarded memory access break 

Cause: This message is displayed if the emulation processor attempts to read or 
write memory mapped as guarded. 

Action: Troubleshoot your program; or, you may have mapped memory incorrectly. 



367 



Chapter 10: Error Messages 

General Emulator and System Messages 

615 Software breakpoint: %s 

Cause: This status message will be displayed if a software breakpoint entered with 
bp and enabled with be -e bp is encountered during a program run. The emulator 
is broken to the monitor. The string %s indicates the address where the breakpoint 
was encountered. 

Action: None. 

61 6 BNC trigger break 

Cause: This status message will be displayed if you have set be -e bnct and the 
BNC trigger line is activated during a program run. The emulator is broken to the 
monitor. 

Action: None. 

617 CMB trigger break 

Cause: This status message will be displayed if you have set be -e cmbt and the 
CMB trigger line is activated during a program run. The emulator is broken to the 
monitor. 

Action: None. 

618 trigl break 

Cause: This status message will be displayed if you have set the analyzer to drive 
trigl upon finding the trigger, be -e trigl is set, and the analyzer has found the 
trigger condition while tracing a program run. The emulator is broken to the 
monitor. 

Action: None. 

61 9 trig2 break 

Cause: This status message will be displayed if you have set the analyzer to drive 
trig2 upon finding the trigger, be -e trig2 is set, and the analyzer has found the 
trigger condition while tracing a program run. The emulator is broken to the 
monitor. 

Action: None. 
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620 Unexpected software breakpoint 

Cause: If you have enabled software breakpoints with be -e bp, this message is 
displayed if a software breakpoint instruction is encountered in your program that 
was not inserted by bp and is therefore not in the breakpoint table. 

Action: If your processor allows different software breakpoint instructions, either 
modify the ones you inserted in your code, or modify the ones inserted by bp using 
your emulator's configuration options (cf command). If only one instruction is 
available, remove those inserted in your code before assembly and link, then 
reinsert them using the bp command. 

621 Unexpected step break 

Cause: System failure. 

Action: Run performance verification (pv command). 

622 %s 

Cause: Monitor specific message. 
Action: None. 

623 CMB execute break 

Cause: This message occurs when coordinated measurements are enabled and an 
EXECUTE pulse causes the emulator to run; the emulator must break before 
running. 

Action: This is a status message; no action is required. 

624 Configuration aborted 

Cause: Occurs when a <CTRL>c is entered during cf display command. 
Action: None. 



625 Invalid configuration value: %s 



Cause: You have entered a configuration option incorrectly, such as typing cf 
rrt=onn instead of cf rrt=on. 
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Action: Re-enter the configuration command, specifying only the correct options. 
Enter the help cf command for a description of the configuration options for your 
emulator. 

626 Configuration failed; setting unknown: %s=%s 
Cause: Target condition or system failure. 

Action: Check target system, and run performance verification (pv command). 

627 Invalid configuration item: %s 

Cause: You specified a non-existent configuration item in the cf command. For 
example, you would see this message if you tried to enter cf clk=int since there is 
no elk configuration item for the emulator. 

Action: Re-enter the command, specifying only configuration items that are 
supported by your emulator. Enter the help cf command for a description of the 
configuration options for your emulator. 

628 Guarded memory break: %s" 

Cause: A memory access to a location mapped as guarded memory has occurred 
during execution of the user program. 

Action: Investigate the cause of the guarded memory access by the user program. 

628 Write to ROM break: %s" 

Cause: When the rom break condition is enabled, a memory write access to a 
location mapped as ROM has occurred during execution of the user program. 

Action: Investigate the cause of the write to ROM by the user program. You can 
disable the break condition with the be -d rom command. 

630 Register access aborted 

Cause: Occurs when a <CTRL>c is entered during register display. 
Action: None. 

631 Unable to read registers in class: %s 

Cause: The emulator was unable to read the registers you requested. 
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Action: To resolve this, you must look at the other status messages displayed. 
Most likely, the emulator was unable to break to the monitor to perform the register 
read. See message 608. 

632 Unable to modify register: %s=%s 

Cause: The emulator was unable to modify the register you requested. 

Action: To resolve this, you must look at the other status messages displayed. It's 
likely that emulator was unable to break to the monitor to perform the register 
modification. See message 608. 

634 Display register failed: %s 

Cause: The emulator was unable to display the register you requested. 

Action: To resolve this, you must look at the other status messages displayed. It's 
likely that emulator was unable to break to the monitor to perform the register 
display. See message 608. 

636 Register not writable: %s 

Cause: This error occurs when you attempt to modify a read only register. 

Action: If this error occurs, you cannot modify the contents of the register with the 
reg command. 

637 Register class cannot be modified: %s 

Cause: You tried to modify a register class instead of an individual register. 

Action: You can only modify individual registers. Refer to the reg command 
description for a list of register names. 

640 Unable to reset 

Cause: Target condition or system failure. 

Action: Check target system, and run performance verification (pv command). 

641 Unable to reset into monitor 

Cause: You have entered a rst -m command and the emulator is unable to break 
into the monitor. 
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Action: Reload monitor (rst for background). 

650 Unable to configure break on write to ROM 

Cause: The emulator controller is unable to execute the be -e rom command 
correctly, possibly because the emulator was left in an unknown state or because of 
a hardware failure. 

Action: Initialize the emulator or cycle power. Then reenter the command. If the 
same failure occurs, call your HP sales and service office. 

651 Unable to configure break on software breakpoints 

Cause: The emulator controller is unable to execute the be -e bp command, 
possibly because the emulator is in an unknown state or because of a hardware 
failure. 

Action: Initialize the emulator or cycle power, then re-enter the command. If the 
same failure occurs, call your HP sales and service office. 

652 Break condition must be specified 

Cause: You entered be -e or be -d without specifying a break condition to enable 
or disable. 

Action: Re-enter the be command along with the enable/disable flag and the break 
condition you wish to modify. 

653 Break condition configuration aborted 

Cause: Occurs when <CTRL>c is entered during be display. 
Action: None. 

661 Software breakpoint break condition is disabled 

Cause: You entered the bp command and options; however, the software 
breakpoint break condition is disabled. 

Action: Enable the software breakpoint feature with be -e bp, then enter the 
desired breakpoints with bp. 
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663 Specified breakpoint not in list: %s 



Cause: You tried to enable a software breakpoint (bp -e <ADDRESS>) that was 
not previously defined. The string %s prints the address of the breakpoint you 
attempted to enable. 

Action: Insert the breakpoint into the table and memory by typing bp 
<ADDRESS>. 



664 Breakpoint list full; not added: %s 

Cause: The software breakpoint table is full. The breakpoint you just requested, 
with address %s, was not inserted. 

Action: Remove breakpoints that are no longer in use with bp -r <ADDRESS>. 
Then insert the new breakpoint. 

665 Enable breakpoint failed: %s 

Cause: System failure or target condition. 

Action: Check memory mapping and configuration questions. 

666 Disable breakpoint failed: %s 

Cause: System failure or target condition. 

Action: Check memory mapping and configuration questions. 

667 Breakpoint code already exists: %s 

Cause: You attempted to insert a breakpoint with bp <ADDRESS>; however, 
there was already a software breakpoint instruction at that location which was not 
already in the breakpoint table. 

Action: Your program code is apparently using the same breakpoint instruction as 
bp. If multiple breakpoint instructions are available on your processor, either 
change those in your program code or modify the one bp uses with your emulator's 
configuration options (cf command). If only one instruction is available, remove 
the breakpoints from your program code and use bp to insert breakpoints. 
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668 Breakpoint not added: %s 

Cause: You tried to insert a breakpoint in a memory location which was not 
mapped or was mapped as guarded memory. 

Action: Insert breakpoints only within memory ranges mapped to emulation or 
target RAM or ROM. 

669 Breakpoint remove aborted 

Cause: Occurs when <CTRL>c is entered during a bp -r command. 
Action: None. 

670 Breakpoint enable aborted 

Cause: Occurs when <CTRL>c is entered during a bp -e command. 
Action: None. 

671 Breakpoint disable aborted 

Cause: Occurs when <CTRL>c is entered during a bp -d command. 
Action: None. 

680 Stepping failed 

Cause: Stepping has failed for some reason. 

Action: Usually, this error message will occur with other error messages. Refer to 
the descriptions of the accompanying error messages to find out more about why 
stepping failed. 

682 Invalid step count: %s 

Cause: You specified an non-cardinal value for a step count in the s command 
(such as entering s 22.1). 

Action: Reenter the step command, using only cardinal values (positive integers) 
for the step count. 

684 Failed to disable step mode 

Cause: System failure. 
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Action: Run performance verification (pv command). 



685 Stepping aborted 

Cause: This message is displayed if a break was received during a s (step) 
command with a stepcount of zero (0). The break could have been due to any of 
the break conditions in be or a <CTRL>c break. 

Action: None. 

686 Stepping aborted; number steps completed: %d 

Cause: This message is displayed if a break was received during a s (step) 
command with a stepcount greater than zero. The break could have been due to 
any of the break conditions in be or a <CTRL>c break. The number of steps 
completed is displayed. 

Action: None. 

688 Step display failed 

Cause: System failure or target condition. 

Action: Check memory mapping and configuration questions. 

689 Break due to cause other than step 

Cause: An activity other than a step command caused the emulator to break. This 
could include any of the break conditions in a be command or a <CTRL>c break. 

Action: None. 

692 Trace error during CMB execute 

Cause: System failure. 

Action: Run performance verification (pv command). 

693 CMB execute; run started 

Cause: This status message is displayed when you are making coordinated 
measurements. The CMB /EXECUTE pulse has been received; the emulation 
processor started running at the address specified by the rx command. 
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Action: None; information only. 

694 Run failed during CMB execute 

Cause: System failure or target condition. 

Action: Run performance verification (pv command), and check target system. 

700 Target memory access failed 

Cause: This message is displayed if the emulator was unable to perform the 
requested operation on memory mapped to the target system. 

Action: In most cases, the problem results from the emulator's inability to break to 
the monitor to perform the operation. See message 608. 

702 Emulation memory access failed 

Cause: System failure. 

Action: Run performance verification (pv command). 

707 Request access to guarded memory: %s 

Cause: The address or address range specified in the command included addresses 
within a range mapped as guarded memory. When the emulator attempts to access 
these during command processing, the above message is printed, along with the 
specific address or addresses accessed. 

Action: Re-enter the command and specify only addresses or address ranges within 
emulation or target RAM or ROM. Or, you can remap memory so that the desired 
addresses are no longer mapped as guarded. 

71 0 Memory range overflow 

Cause: Accessing a word or short word, for example "m -dw Offfff" will cause a 
rounding error that overflows physical memory. 

Action: Reduce memory display request. 
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720 Invalid map term number: %s 

Cause: You attempted to delete a mapper term that does not exist. For example, 
you may have tried map -d 17 (there are a maximum of 16 mapper terms). Or you 
may have tried map -d 2, when only one mapper term has been defined. 

Action: Use the map command to determine the numbers of the terms currently 
mapped. Then delete the appropriate mapper term. 

721 No map terms available; maximum number already defined 

Cause: You tried to add more than 16 mapper terms. 

Action: Either combine map ranges to conserve on the number of terms or delete 
mapper terms that aren't needed to free another mapper term. 

723 Invalid map address range: %s 

Cause: You specified an invalid address range as an argument to the map 
command. For example, you may have specified digits that don't correspond to the 
base specified, or you forgot to precede a hexadecimal letter digit with a number, or 
the upper boundary of the range you specified is less than the lower boundary. 

Action: Re-enter the map command and the address specification. See the 
<ADDRESS> and <EXPRESSION> syntax pages in the "Commands" chapter for 
information on address specifications. Also, make sure that the upper boundary 
specification is greater than the lower boundary specification (the lower boundary 
must always precede the upper boundary on the command line). 

725 Unable to load new memory map; old map reloaded 

Cause: There is not enough emulation memory left for this request. 
Action: Reduce the amount of emulation memory requested. 

726 Unable to reload old memory map; hardware state unknown 

Cause: System failure. 

Action: Run performance verification (pv command). 
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730 Invalid memory map type: %s 

Cause: You specified a memory type while mapping that is not one of the 
supported types: eram, erom, tram, trom, or grd. 

Action: Re-enter the map command, specifying only one of the five types listed 
above. 

731 Invalid memory map attribute: %s 

Cause: You have entered an unknown attribute when mapping a range of memory. 

Action: Only the dti attribute is available, and they are only valid for emulation 
memory ranges. 

732 Invalid memory type for 'other' range: %s 

Cause: The unmapped memory type must be tram, trom, or grd. If you see the 
above message, you have tried to map the "other" range to eram or erom. 

Action: Map the "other" range to tram, trom, or grd. 

734 Map range overlaps with term: %d 

Cause: You entered a map term whose address range overlaps with one already 
mapped. For example, you may have entered a term map 1000..2fff eram, then 
tried to enter a term map 2000..3fff erom. 

Action: Re-enter the map term so that ranges do not overlap, or combine terms and 
change the memory type. 

736 Memory not mapped as emulation: %s 

Cause: This error occurs when a feature available only for emulation memory is 
attempted with target memory. For example, this error occurs when you attempt to 
perform coverage measurements (see the cov command) on target memory. 

Action: You must remap the address range as emulation memory. 

738 Unable to reset coverage bit data 

Cause: System failure. 

Action: Run performance verification (pv command). 
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740 I/O port access failed 

Cause: The emulator was unable to read or write the port specified in the io 
command. This message is also printed if your processor does not support separate 
I/O. 

Action: If your processor does not support separate I/O, use the m command to 
modify I/O ports. Otherwise, retry the operation, and make sure that you are 
specifying a valid I/O address. 

752 Copy memory aborted; next destination: %s 

754 Memory modify aborted; next address: %s 

756 Memory search aborted; next address: %s 

Cause: One of these message is displayed if a break occurs during processing of 
the cp, m, or ser commands, respectively. The break could result from any of the 
break conditions (except bp) or could have resulted from a <CTRL>c break. 

Action: Retry the operation. If breaks are occurring continuously, you may wish to 
disable some of the break conditions with the be command. 

800 Invalid command: %s 

Cause: You have entered a command which is not part of the standard Terminal 
Interface command set (documented in this manual) and was not found in the 
currently defined macros. 

Action: Enter only commands defined in this manual or in the macro set. You can 
display the macro set using mac. You can rename commands or name command 
groups using the mac command. 

801 Invalid command group: %s 

Cause: This error occurs when you specify an invalid group name in the help -s 
<group> command. 

Action: Enter the help command with no options for a listing of the valid group 
names. 
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802 Invalid command format 

Cause: This error occurs when an invalid macro is entered, for example, mac 
{help;{}. 

Action: Refer to the mac command description. 

807 Macro list full; macro not added 

Cause: The maximum number of macros have been defined. 
Action: You must delete macros before adding any new macros. 

809 Macro buffer full; macro not added 

Cause: This error occurs when the memory reserved for macros is all used up. 
Action: You must delete macros to reclaim memory in the macro buffer. 

812 Invalid macro name: %s 

Cause: You tried to delete a macro that did not exist; or you tried to define a new 
macro with a name containing characters other than letters, digits, or underscores. 

Action: Use the mac command to display the names of macros in the macro table 
before deleting them with mac -d <NAME>. Define new macro names using only 
letters, digits, and underscore characters. 

81 3 Command line too long; maximum line length: %d 

Cause: This error occurs when the command line exceeds the maximum number of 
characters. 

Action: Split the command line into two command lines. 

814 Command line too complex 

Cause: There was not enough memory for the expressions in the command line. 
Action: Split up the command line, or use fewer expressions. 

815 Missing macro parameter: %s 

Cause: This error occurred because you did not include a parameter with the 
specified mac command for macro expansion. 
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Action: Enter the command again, and include the appropriate parameter for the 
macro expansion. 

816 Command line too complex 

Cause: Too many expression operators are used. 

Action: Split up the command line, or use fewer expressions. 

818 Command line too complex 

Cause: A maximum nesting level has been exceeded for nested command 
execution. 

Action: Reduce the number of nesting levels. 



820 Unmatched quote encountered 



Cause: In entering a string, such as with the echo command, you didn't properly 
match the string delimiters (either " or ""). For example, you might have entered 

echo "set SI to off 

Action: Re-enter the command and string, making sure to properly match opening 
and closing delimiters. Note that both delimiters must be the same character. For 
example: echo "set SI to off". 



822 Unmatched command group encountered 

Cause: You entered the mac or rep command group without matching braces {}. 
For example: mac test={rst -m;cf or rep 2 {rst -m;map. 

Action: Re-enter the command, making sure to match braces around commands 
you want grouped into the macro or repeat. For example: mac test={rst -m;cf}. 

824 Maximum number of arguments exceeded 

Cause: Exceeding the limit of 100 arguments per command. 
Action: Reduce the number of arguments in the command. 

826 Maximum argument buffer space exceeded 

Cause: Exceeding space limits for argument lists. 



381 



Chapter 10: Error Messages 

General Emulator and System Messages 

Action: Reduce request. 

840 Invalid date: %s 

Cause: You have specified the date format incorrectly in the dt command. 

Action: Re-enter the command with the correct date format. Refer to the dt 
command description for the correct format. 

842 Invalid time: %s 

Cause: You have incorrectly specified the time format in the dt command. 

Action: Re-enter the command with the correct time format. Refer to the dt 
command description for the correct format. 

844 Invalid repeat count: %s 

Cause: You entered a non cardinal value for the repeat count in the rep command, 
such as rep 22.1 <command_group>. 

Action: Re-enter the rep command, specifying only a cardinal number (positive 
integer) for the repeat count. 

850 Attempt to load code outside of allocated bounds 

Cause: This error occurs when the led command attempts to load an absolute file 
that contains code or data outside the range allocated for system code. 

Action: Generally, you will not use the led command. The led command is 
intended to be used by high-level interfaces to the HP 64700. 

875 Invalid syntax for global or user symbol name: %s 

Cause: This error occurs when you enter a global or user symbol name with 
incorrect syntax. 

Action: Make sure that you enter the global or user symbol name using the correct 
syntax. When specifying a global symbol, make sure that you precede the global 
symbol with a colon (for example, :glb_sym). When specifying a user symbol 
(created with the sym command), make sure that you enter the name correctly 
without a colon. 
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876 Invalid syntax for local symbol or module: %s 

Cause: This error occurs when you enter a local symbol or module name with 
incorrect syntax. 

Action: When entering a local symbol name using the sym command, make sure 
that you specify the module name, followed by a colon, then the symbol name (for 
example module :loc_sym). Make sure that you specify the module name correctly. 

877 Symbol not found: %s 

Cause: This occurs when you try to enter a symbol name that doesn't exist. 
Action: Enter a valid symbol name. 

878 Symbol cannot contain wildcard in this context 

Cause: You tried to enter a global, local, or user symbol name using the wildcard 
(*) incorrectly. 

Action: When you enter the symbol name again, include the wildcard (*) at the end 
of the symbol. 

879 Symbol cannot contain text after the wildcard 

Cause: You tried to include text after the wildcard specified in the symbol name 
(for example, sym*text). 

Action: Enter the symbol again, but don't include text after the wildcard (*). 

880 Conflict between expected and received symbol information 

Cause: The information you supplied in a symbol definition is not what the 
HP 64700 expected to receive. 

Action: Make sure that all symbols in the symbol file are defined correctly. Verify 
that there are no spaces in the address definitions for the symbols in the symbol file 
being downloaded. 

881 Ascii symbol download failed 

Cause: This error occurs because the system is out of memory. 
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Action: You must either reduce the number of symbols to be loaded, or free up 
additional system space and try the download again. 



882 No module specified for local symbol 

Cause: This error occurs because you tried to specify a local symbol name without 
specifying the module name where the symbol is located. 

Action: Enter the module name where the local symbol is located, followed by a 
colon, then the local symbol name. 



901 Invalid firmware for emulation subsystem 

Cause: This error occurs when the HP 64700 system controller determines that the 
emulation firmware (ROM) is invalid. 

Action: This message is not likely to occur unless you have upgraded the ROMs in 
your emulator. Be sure that the correct ROM is installed in the emulation controller. 



902 Invalid analysis subsystem; product address: %s 

Cause: This error occurs when the HP 64700 system controller determines that the 
analysis firmware (ROM) is invalid. 

Action: This message is not likely to occur unless you have upgraded the ROMs in 
your emulator. Be sure that the correct ROMs are installed in the analyzer board. 



903 Invalid ET subsystem; product address: %s 

Cause: Detects an invalid ET. Used only internally. 
Action: None. 



904 Invalid auxiliary subsystem; product address: %s 

Cause: For future products. 
Action: None. 



911 Lab firmware for emulation subsystem 

Cause: This message should never occur. It shows that you have an unreleased 
version of emulation firmware. 
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912 Lab firmware analysis subsystem; product address: %s 

Cause: This message should never occur. It shows that you have an unreleased 
version of analysis firmware. 

Action: None. 

91 3 Lab firmware subsystem; product address: %s 

Cause: This message should never occur. It shows that you have an unreleased 
version of system controller firmware. 

Action: None. 

914 Lab firmware auxiliary subsystem; product address: %s 

Cause: This message should never occur. It shows that you have an unreleased 
firmware version of the auxiliary subsystem. 

Action: None. 
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Analyzer Messages 

1 1 02 Invalid bit range; crosses two multiples of 16: <sig#>..<sig#> 

Cause: This error occurs when defining trace labels. A trace label may not contain 
trace signals crossing two 16-bit boundaries. For example, the command "tlb 
name 1..32" will cause this error because "name" contains signals which cross the 
15-16 and 31-32 16-bit boundaries. 

Action: Redefine your trace label so that no more than one 16-bit boundary is 
crossed. 

1 1 03 Invalid bit range; out of bounds: <sig#>..<sig#> 

Cause: This error occurs when defining trace labels, and you have attempted to 
assign non-existent trace signals to a label. 

Action: Enter the trace activity command to view the trace signals present, and use 
only these signals when defining trace labels. 

1 1 04 Invalid bit range; too wide: <sig#>..<sig#> 

Cause: This error occurs when defining trace labels, and you have attempted to 
assign more than 32 trace signals to a label. 

Action: Use more than one trace label to define over 32 trace signals. 

1 1 05 Unable to delete label; used by emulation analyzer: <label> 

Cause: This error occurs when you attempt to delete an emulation trace label 
which is currently being used as a qualifier in the emulation trace specification or is 
currently specified in the emulation trace format. 

Action: Display the emulation trace sequencer specification in the easy 
configuration, display the emulation trace patterns in the complex configuration, or 
display the trace format to see where the label is used. Also, you should check tpq 
for uses of that label. You must change the pattern or format specification to 
remove the label before you can delete it. 
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1 1 06 Unable to delete label; used by external state analyzer: <label> 

Cause: This error occurs when you attempt to delete an external trace label which 
is currently being used as a qualifier in the external state trace specification or is 
currently specified in the external trace format. 

Action: Display the external trace sequencer specification in the easy 
configuration, display the external trace patterns in the complex configuration, or 
display the external trace format to see where the label is used. Also, check tpq for 
uses of that label. You must change the pattern or format specification to remove 
the label before you can delete it. 

1 1 07 Unable to delete label; used by external timing analyzer: <label> 

Cause: This error occurs when you attempt to delete an external trace label which 
is currently being used as a qualifier in the external timing trace specification. 

Action: Remove the label from the external timing analyzer specifications, and 
then delete the label. 

1 1 08 Unable to redefine label; used by emulation analyzer: <label> 

Cause: This error occurs when you attempt to redefine an emulation trace label 
which is currently used as a qualifier in the emulation trace specification. 

Action: Display the emulation trace sequencer specification in the easy 
configuration, display the emulation trace patterns in the complex configuration, or 
display the emulation trace format to see where the label is used. You must change 
the pattern or format specification to remove the label before you can redefine it. 

1 1 09 Unable to redefine label; used by external state analyzer: <label> 

Cause: This error occurs when you attempt to redefine an external trace label 
which is currently used as a qualifier in the external state trace specification. 

Action: Display the external trace sequencer specification in the easy 
configuration, or display the external trace patterns in the complex configuration to 
see where the label is used. You must change the pattern or format specification to 
remove the label before you can redefine it. 
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1110 Unable to redefine label; used by external timing analyzer: <label> 

Cause: This error occurs when you attempt to redefine an emulation or external 
trace label which is currently being used as a qualifier in the external timing trace 
specification. 

Action: Remove the label from the external timing analyzer specifications, and 
then redefine the label. 

1111 Unable to redefine label; belongs to external analyzer: <label> 

Cause: This error occurs when you attempt to redefine an external analyzer label 
with the emulation trace label command (for example, tlb xbits 0..16). 

Action: Either use a different label name, or delete the external analyzer label 
before defining a label of the same name for the emulation analyzer. 

1112 Unable to redefine label; belongs to emulation analyzer: <label> 

Cause: This error occurs when you attempt to redefine an emulation analyzer label 
with the external trace label command (for example, xtlb addr 0..19). 

Action: Either use a different label name, or delete the emulation analyzer label 
before defining a label of the same name for the external analyzer. 

1114 Label belongs to external analyzer: <label> 

Cause: When the external analyzer is in an independent mode, this error occurs 
when you attempt to use an external analyzer label in an emulation trace command 
(for example, tg xlabel=0). 

Action: Only use external trace labels in external trace commands (when the 
external analyzer is in an independent mode). 

1115 Label belongs to emulation analyzer: <label> 

Cause: When the external analyzer is in an independent mode, this error occurs 
when you attempt to use an emulation analyzer label in an external trace command 
(for example, xtg addr=5). 

Action: Only use emulation trace labels in emulation trace commands (when the 
external analyzer is in an independent mode). 
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1130 Illegal base for count display 



Cause: When specifying the trace format, counts may only be displayed relative or 
absolute. When counting states, the count is always displayed as a decimal number. 

Action: Respecify the trace format without using a base for the count column. 
Also, you can use ",A" to specify that counts be displayed absolute, or you can use 
",R" to specify that counts be displayed relative. 

1131 Illegal base for mnemonic disassembly display 

Cause: When specifying the trace format, you cannot specify a number base for the 
column containing mnemonic information. 

Action: Respecify the trace format without using a base for the mnemonic column. 

1 1 32 Illegal base for sequencer display 

Cause: When specifying the trace format, you cannot specify a number base for the 
column containing sequencer information. 

Action: Respecify the trace format without using a base for the sequencer column. 

1 1 33 Trace format command failed; using old format 

Cause: This error occurs when the trace format command fails for some reason. 
This error message always occurs with another error message. 

Action: Refer to the "Action" description for the other error message displayed. 

1137 Mnemonic disassembly not supported for external trace 

Cause: This error occurs when you attempt to specify a mnemonic information 
column in the external trace format. There is no mnemonic disassembly for the 
external trace. 

Action: Respecify the trace format without the mnemonic column. 

1 1 38 Illegal width for symbol display: %s 

Cause: This error occurs when the value specified for the trace format address field 
width is not valid. 
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Action: Enter the tf command again, and specify the width of the address field for 
symbol display within the range of 4 to 55. 

1139 Illegal width for addr display, mne not specified 

Cause: This error occurs when you specify a width for the address field in the tf 
command, but do not include the mne option. 

Action: Enter the command again, and include the mne option. 

1 1 40 Symbol display unsupported 

Cause: This error occurs when you try to display symbols in the trace list, but the 
emulator you are using doesn't support symbols. 

Action: Enter the tl command again, but don't try to display symbols. 

1141 Symbol display unavailable without mne field 

Cause: This error occurs when you try to display symbols, but have not included 
the mne option to the tf command. 

Action: Don't try to display symbols unless the mne field has already been 
specified. 

1 202 Trigger position out of bounds: <bounds> 

Cause: This error occurs when you attempt to specify a number of lines to appear 
either before or after the trigger which is greater than the number of lines allowed. 
The <bounds> string indicates the incorrect range that you typed (not the correct 
limits on the range). 

Action: Be sure that the trigger position specified is within the range -1024 to 1023. 

1 207 Invalid clock channel: <name> 

Cause: Valid clock channels are L, M, and N. If you have an external analyzer, the 
J and K channels are also valid. 

Action: Respecify the command using valid clock channels. 
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1209 Operator must be "and" or "or": <expression> 

Cause: When combining trace labels to specify trace patterns (in simple 
expressions or with the tpat command), an operator of either "and" or "or" must 
appear between the label qualifiers. 

Action: Refer to the "Qualifying Trigger and Store Conditions" section of the 
"Using the Emulation Analyzer - Easy Configuration" chapter. 

1210 Illegal mix of = and ! = 

Cause: When combining trace labels to specify patterns (in simple expressions or 
with the tpat command), all labels must either be equal to values or not equal to 
values. 

Action: Refer to the "Qualifying Trigger and Store Conditions" section of the 
"Using the Emulation Analyzer - Easy Configuration" chapter. 

1211 Illegal mix of and/or 

Cause: When combining trace labels to specify patterns (in simple expressions or 
with the tpat command), all label qualifiers must either be ANDed together or 
ORed together. You cannot mix these operators. 

Action: Refer to the "Qualifying Trigger and Store Conditions" section of the 
"Using the Emulation Analyzer - Easy Configuration" chapter. 

1212 Conflict with overlapping label: <label> 

Cause: When combining trace labels to specify patterns (in simple expressions or 
with the tpat command), you cannot combine labels which are defined for common 
trace signals. For example, the following easy configuration commands will result 
in this error: tlb low8 0..7; tlb lowl6 0..15; tg low8=0 and lowl6=l. 

Action: Either omit one of the overlapping labels, or redefine your labels so that 
they do not contain common trace signals. You could also circumvent this error by 
using don't cares in the appropriate places; for the example shown in cause, you 
could specify patterns tg 1ow8=0xx0xY and lowl6=l. 

1213 Illegal mix of !=/and 

Cause: When combining trace labels to specify patterns (in simple expressions or 
with the tpat command), labels which are not equal to values must be ORed 
together so that the entire pattern specifies a "not equals" condition. 
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Action: Refer to the "Qualifying Trigger and Store Conditions" section of the 
"Using the Emulation Analyzer - Easy Configuration" chapter. 

1214 Illegal mix of =/or 

Cause: When combining trace labels to specify patterns (in simple expressions or 
with the tpat command), labels which are equal to values must be ANDed together 
so that the entire pattern specifies an "equals" condition. 

Action: Refer to the "Qualifying Trigger and Store Conditions" section of the 
"Using the Emulation Analyzer - Easy Configuration" chapter. 

1215 Comparator must be = or !=: <label> 

Cause: When combining trace labels to specify patterns (in simple expressions or 
with the tpat command), the value of the label can only be specified with the "=" or 
"!=" operators. 

Action: Refer to the "Qualifying Trigger and Store Conditions" section of the 
"Using the Emulation Analyzer - Easy Configuration" chapter. 

1217 Illegal pattern name: <name> 

Cause: Valid pattern names are pi through p8. 
Action: Use only valid pattern names. 

1218 Illegal comparator for range qualifier: != 

Cause: When specifying a range with the trng command, you cannot use the" !=" 
operator. 

Action: Use the " !r" range name. 

1219 Range cannot be combined with any other qualifier 

Cause: For example, the following easy configuration command will result in this 
error: tsto addr=400..4ff and data=40. 

Action: Do not attempt to combine labels when using range qualifiers. 
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1221 Range resource in use 

Cause: This error occurs when you attempt to use two different range expressions 
in the "easy" configuration trace specification or when you attempt to redefine the 
"complex" configuration range resource while it is currently being used as a 
qualifier in the trace specification. 

Action: Only one range expression may be used in the "easy" configuration trace 
specification. In the "complex" configuration, display the sequencer specification 
to see where the range resource is being used and remove it; then, you can redefine 
the range resource. 

1 224 Sequence term number out of range: <term> 

Cause: This error occurs when a sequencer qualification command (tif, telif, tsq, 
or tsto) specifies a non-existent sequence term. The easy configuration sequencer 
may have a maximum of 4 sequence terms. Eight sequence terms exist in the 
complex configuration sequencer. 

Action: Re-enter the command using an existing sequence term. 

1 225 Sequence term not contiguous: <term> 

Cause: This error occurs when you attempt to insert a sequence term which is not 
between existing terms or after the last term. For example, the following easy 
configuration commands will result in this error: tg any; tsq -i 4. 

Action: Be sure that the sequence term you enter is either between existing 
sequence terms or after the last sequence term. 

1 226 Too many sequence terms 

Cause: This error occurs when you attempt to insert more than 4 sequence terms. 
Action: Do not attempt to insert more than 4 sequence terms. 

1227 Sequence term not defined : <term> 

Cause: This error occurs when you attempt to delete, or specify a primary branch 
expression for, a sequence term number which is possible, but which is not 
currently defined. 

Action: Insert the sequence term, and respecify the primary branch expression for 
that term. 
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1 228 One sequence term required 

Cause: This error occurs when you attempt to delete terms from the sequencer 
when only one term exists. 

Action: At least one term must exist in the sequencer. Do not attempt to delete 
sequence terms when only one exists. 

1 234 Invalid occurrence count: <number> 

Cause: Occurrence counts may be from 1 to 65535. 

Action: Re-enter the command with a valid occurrence count. 

1 235 Illegal threshold value: <value> 

Cause: Threshold voltage specifications may be from -6.4 V to +6.35 V in 
increments of 0.05 V. 

Action: Re-enter the command with a valid threshold voltage. 

1 237 Option specified more than once: <option> 

Cause: When specifying external threshold voltages, this error occurs when you 
attempt to specify the threshold voltage for either the upper or lower byte twice. 

Action: You must re-enter the command so that the threshold voltage is only 
specified once for each option (upper or lower byte). 

1 239 Clock speed not available with current count qualifier. 

Cause: This error occurs when you attempt to specify a fast (F) or very fast (VF) 
maximum qualified clock speed when counting time (tcq time). This error also 
occurs when you attempt to specify a very fast (VF) maximum qualified clock 
speed when counting states (for example, tcq addr=400). 

Action: Change the count qualifier; then, re-enter the command. 

1 240 Count qualifier not available with current clock speed. 

Cause: This error occurs when you attempt to specify the "time" count qualifier 
when the current maximum qualified clock speed is fast (F) or very fast (VF). This 
error also occurs when you attempt to specify a "state" count qualifier when the 
maximum qualified clock speed is fast (F). 
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Action: Change the clock speed; then, change the count qualifier. 

1 241 Invalid qualifier resource or operator: <expression> 

Cause: When specifying complex expressions, you have either specified an illegal 
pattern or used an illegal operator. 

Action: Refer to the "Using Complex Expressions" section of the "Using the 
Emulation Analyzer - Complex Configuration" chapter for information on valid 
patterns and operators. 

1 245 Range qualifier not accessible in easy configuration 

Cause: This error occurs when you attempt to use the trng command in the easy 
configuration. 

Action: Changing into the complex configuration will allow you to use the trng 
command; otherwise, specify the range in easy configuration command expressions. 

1 246 Pattern qualifiers not accessible in easy configuration 

Cause: This error occurs when you attempt to use the tpat command in the easy 
configuration. 

Action: Changing into the complex configuration will allow you to use the tpat 
command; otherwise, specify the patterns in easy configuration command 
expressions. 

1 248 Range term used more than once 

Cause: This error occurs when you attempt to use the range resource more than 
once in a sequencer branch expression. 

Action: You cannot use the range resource more than once in a sequencer branch 
expression. 

1 249 Invalid qualifier expression: <expression> 

Cause: This error message is shown with the errors that occur when patterns, the 
range, or the arm condition is used more than once within a set. This error message 
also occurs when intraset operators are not the same. For example, the following 
complex expression will result in this error: pi ~ p2 I p3. 
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Action: Refer to the "Using Complex Expressions" section of the "Using the 
Emulation Analyzer - Complex Configuration" chapter for information on valid 
patterns and operators. 

1 250 Arm term used more than once 

Cause: This error occurs when you attempt to use the "arm" qualifier more than 
once in a sequencer branch expression. 

Action: You cannot use the "arm" qualifier more than once in a sequencer branch 
expression. 

1 251 Trigger term cannot be term 1 

Cause: This error occurs when to attempt to specify the first sequence term as the 
trigger term. The trigger term may be any term but the first. 

Action: Respecify the trigger term as any other sequence term. 

1 253 Invalid pod number: <pod#> 

Cause: This error message occurs when you attempt to specify a slave clock for a 
non-existent analyzer pod. 

Action: Use the trace activity command to display the valid pod numbers, and use 
only these numbers when entering commands. 

1 257 Pod belongs to external analyzer: <pod#> 

Cause: This error occurs when you attempt to specify a slave clock for the external 
analyzer pod with the emulation analyzer's trace slave clock command. This error 
only occurs when the external analyzer is in its independent state mode. 

Action: Use the external trace slave clock command to specify a slave clock for the 
external analyzer pod. 

1 300 Incompatible external trace mode 

Cause: This error message occurs when you attempt to use an external trace 
command (other than xtv, xtlb, or xtmo) while the external analyzer is aligned with 
the emulation analyzer. The message is also display if you attempt to use external 
state trace commands when the external analyzer is in timing mode; or if you 
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attempt to use external timing trace commands when the external analyzer is in 
state mode. 

Action: Change the external trace mode, and re-enter the command. 

1 301 External label in use: <label> 

Cause: This error occurs when you attempt to select the external analyzer's 
independent state mode while an external trace label is currently used as a qualifier 
in the emulation analyzer trace specification. 

Action: Remove any external trace label qualifiers from emulation trace 
specifications before selecting the external analyzer's independent state mode. 

1 302 Trigl signal cannot be driven and received 

Cause: This error occurs when you attempt to specify the internal trigl signal as 
the trace arm condition while the same analyzer's trigger output is currently driving 
the trigl signal. This error also occurs if you attempt to specify that the trigger 
output drive the internal trigl signal while that signal is currently specified as the 
arm condition for the same analyzer. 

Action: You can either change the arm or the trigger output specification; in either 
case, make sure that they do not use the same internal signal. 

1 303 Trig2 signal cannot be driven and received 

Cause: This error occurs when you attempt to specify the internal trig2 signal as 
the trace arm condition while the same analyzer's trigger output is currently driving 
the trig2 signal. This error also occurs if you attempt to specify that the trigger 
output drive the internal trig2 signal while that signal is currently specified as the 
arm condition for the same analyzer. 

Action: You can either change the arm or the trigger output specification; in either 
case, make sure that they do not use the same internal signal. 

1 304 Analyzer trace running 

Cause: This error occurs when you attempt to change the external analyzer mode 
while a trace is in progress. 

Action: Halt the trace before changing the external analyzer mode. 
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1 305 CMB execute; emulation trace started 

Cause: This status message informs you that an emulation trace measurement has 
started as a result of a CMB execute signal (as specified by the "tx -e" command). 

1 306 CMB execute; external trace started 

Cause: This status message informs you that an emulation trace measurement has 
started as a result of a CMB execute signal (as specified by the "xtx -e" command). 

2021 Period not in 1/2/5 sequence: <period> 

Cause: This error message occurs when the external timing sample period is not in 
a 1/2/5 sequence; for example, 10ns, 20ns, 50ns, 100ns, 200ns, 500ns, lus, 2us, 
5us, etc. Some examples of invalid sample period specifications are: 12ns, 18ns, 
25ns, 60ns, 80ns, etc. 

Action: Use a number in the 1/2/5 sequence when specifying the external timing 
sample period. 

2022 Sample period out of bounds: <bounds> 

Cause: The external timing sample period must be between 10 ns and 50 ms (in a 
1/2/5 sequence). 

Action: Re-enter the command with the sample period between the bounds shown. 

2030 Negated patterns not allowed in timing 

Cause: This error occurs when you attempt to specify a "not equals" expression 
when defining the external timing trigger. You can only specify labels which equal 
patterns (of l's, 0's, or X's). 

Action: Do not attempt to specify negated timing patterns. 

2031 Invalid trigger duration: <duration> 

Cause: This error occurs when you attempt to specify an external timing trigger 
duration which is in the valid range but is not a multiple of 10 ns. 

Action: Re-enter the command with the trigger duration as a multiple of 10 ns. 
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2032 Trigger duration out of bounds: <bounds> 

Cause: This error occurs when you attempt to specify an external timing trigger 
duration outside the valid range. A "greater than" duration must fall within the 
range of 30 ns to 10 ms (and must be a multiple of 10 ns). A "less than" duration 
must fall within the range 40 ns to 10ms (and must be a multiple of 10 ns). 

Action: Re-enter the command with the trigger duration within the bounds shown. 

2042 Trigger delay out of bounds: <bounds> 

Cause: This error occurs when you attempt to specify an external timing trigger 
delay outside the valid range. The external timing trigger delay must be between 0 
and 10 ms (in 10 ns increments). 

Action: Re-enter the command with the trigger delay within the bounds shown. 
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Emulator Specifications and Characteristics 

This section contains the following types of emulator specifications and 
characteristics: 

• Electrical characteristics (including emulator timing). 

• Physical characteristics. 

• Environmental characteristics. 

Electrical 

This section describes the electrical characteristics of the HP 64767 
80186/8/XL/EA/EB/EC Emulator and the HP 64700 Card Cage. 

Electrical Characteristics of the HP 64767 Emulator 

Except as noted in the specifications, all electrical differences defined by Intel 
between the 80C186 and XL processors also apply to the HP 64767 emulator as far 
as compatibility with processors is concerned. Refer to Intel compatibility 
documentation for differences between the processors. 

Maximum clock speed: 20 MHz with no wait states required for emulation or 
target memory. 

Minimum clock speed: 1 MHz. 

Power: 250 mA maximum from target system, all other power supplied by 
card cage. 
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Below are specifications for the HP 64767 A/B/C that differ from the specifications 
for the Intel 80C 1 86EA/EB /EC/XL processors. 



DC Specifications (at V cc = 5V): 


Min 


Max 


Input low voltage 


-0.5V 


0.8V 


Input high voltage (HP 64767 A) 


2.0V 


Vcc + 0.5V 


Input high voltage (HP 64767B/C) 


0.7 * Vcc 


Vcc + 0.5V 


Output high voltage 

(AD pins 15 through 0: -15 mA) 


2.4V 




Output high voltage 

(AD pins 15 through 0: -300 ^A) 


Vcc - 0.2V 




Output high voltage 

(HP 64767A - other pins: -200 |aA) 


Vcc - 0.5V 




Output high voltage 

(HP 64767A - other pins: -2.4 mA) 


2.4V 




Output high voltage 

(HP 64767B/C - other pins: -2 mA) 


Vcc - 0.5V 




Low level input current (HOLD) 


-250 (J.A 




High level input current (HOLD) 




100 nA 


Pin capacitance 




approx 30 pF 
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AC Specifications (at V C c = 5V): 


Min 




Max 


Read data setup time (Tdvcl) 


15 ns 






Read data hold time (Tcldx) 


8 ns 






Address valid delay (Tclav) 


4 ns 




32 ns 


Data valid delay (Tcldv) 


4 ns 




32 ns 


Address valid to ALE low (Tavll) 


(Tclch - 


15 ns) 




Address valid to clock high (Tavch) 


-5 ns 






Address float delay (Tclaz) 






30 ns 


Address float to LRD active (Tazrl) 


-10 ns 






Data valid delay (Tcldv) 


4 ns 




32 ns 


CLKOUT frequency 


1 MHz 




20 MHz 


AC Specifications tor 

HP 64767AL/BL/CL (at V cc = 3V): 


Min 




Max 


Read data setup time (Tdvcl) 


25 ns 






Read data hold time (Tcldx) 


8 ns 






Address valid delay (Tclav) 


4 ns 




35 ns 


Data valid delay (Tcldv) 


4 ns 




35 ns 


Address valid to ALE low (Tavll) 


(Tclch - 


15 ns) 




Address valid to clock high (Tavch) 


-5 ns 






Address float delay (Tclaz) 






30 ns 


Address float to LRD active (Tazrl) 


-10 ns 






Data valid delay (Tcldv) 


4 ns 




35 ns 


CLKOUT frequency 


1 MHz 




13 MHz 
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Electrical Notes 

A target system NMI request may be delayed by three clock cycles while running 
user code or indefinitely while running in the background monitor. NMI requests 
recieved while in the background monitor are latched and delivered to the 
emulation processor after exiting the monitor. Other external interrupts will not be 
serviced while in the background monitor and are not latched by emulation 
hardware. These interrupts must remain asserted until acknowledged by the 
emulation processor. 

The RESIN signal is delayed by approximately 500 ns between the target system 
and the emulation processor. 

ALE will continue to be asserted to the target system during background monitor 
cycles although no other bus status or control signals will be asserted. 



Electrical Characteristics of the HP 64700 

The electrical characteristics of the HP 64700 communication ports are as follows. 
Communications 

Serial Port RS-232-C DCE or DTE to 38.4 Kbaud. 

RS-422 DCE to 460.8 Kbaud. 

BNC (labeled Input. The signal must drive approximately 4 mA at 2 V. Edge 
TRIGGER IN/OUlSensitive. Minimum pulse width is approximately 25 ns. 

Output. Driven active high only; equals +2.4V into a 50 ohm 

load. 
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Physical 

Emulator Dimensions 

Width 325 mm (12.8 in.) 

Height 173 mm (6.8 in.) 

Length 389 mm (15.3 in.) 

Emulator Weight 

HP 64749 8.2 kg (18 lb) 

Cable Length 

Probe to approximately 914 mm (36 in.) 

card cage 

Communications 

Serial Port 25-pin female type "D" subminiature connector. 

CMB Port 9-pin female type "D" subminiature connector. 

CAUTION Possible damage to emulator. Any component used in suspending the emulator 

must be rated for 30 kg (65 lb) capacity. 
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Environmental 

Temperature 

Operating 0°C to +40°C 

(+32°F to 104°F) 

Non-operating -40°C to +70°C 
(-40°Fto 158°F) 

Altitude 

Operating/ 4 600m 

Non-operating (15 000 ft) 
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External Analyzer Specifications 

Threshold Accuracy = +/- 50 mV. 
Dynamic Range = +/- 10 V about threshold setting. 
Minimum Input Swing = 600 mV pp. 

Minimum Input Overdrive = 250 mV or 30% of threshold setting, whichever 
greater. 

Absolute Maximum Input Voltage = +/- 40 V. 
Probe Input Resistance = 100K ohms +/- 2%. 
Probe Input Capacitance = approximately 8 pF. 
Maximum +5 Probe Current = 0.650 A. 
+5 Probe Voltage Accuracy = +5.0 +/- 5%. 

External State Analyzer Specifications 

Data Setup Time = 10 ns min. 
Data Hold Time = 0 ns, typical. 
Qualifier Setup Time = 20 ns min. 
Qualifier Hold Time = 10 ns, typical. 
Minimum Clock Width = 10 ns 
Minimum Clock Period: 

- No Tagging Mode = 40 ns (25 Mhz clock). 

- Event Tagging Mode = 50 ns (20 MHz clock). 

- Time Tagging Mode = 60 ns (16 MHz clock). 
Minimum Time from Slave Clock to Master Clock = 10 ns. 
Minimum Time from Master Clock to Slave Clock = 50 ns. 



Part 4 



Concept Guide 

Topics that explain concepts and apply them to advanced tasks. 
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This chapter provides conceptual information on the following topics: 
• Demo program descriptions. 
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Demo Program Description 

A simple environmental control system demonstration program has been used to 
generate examples throughout this manual. The program controls the temperature 
and humidity of a room requiring accurate environmental control. 

This demo program is a simple C language program and is linked with startup and 
initialization code. 



Environmental Control System (ECS) Code 
The "demo.h" File 

A Hewlett-Packard Software Product 
Copyright Hewlett-Packard Co. 1992 



All Rights Reserved. Reproduction, adaptation, or translation without prior 
written permission is prohibited, except as allowed under copyright laws. 
******************************************************************************/ 

typedef enum {false, true} boolean; 
typedef enum {up, down} direction; 



typedef struct 
{ 

short temp; 
short humid; 
float ave_temp; 
float ave_humid; 
} old_el; 



/** 



t * * * * * 



* Global Variables 
******************** / 

extern short target_temp; 
extern short target_humid; 



/* Target temperature. */ 
/* Target humidity. */ 



extern short current_temp; /* Current temperature. */ 

extern short cur rent_humid; /* Current humidity. */ 

extern int num_checks; /* Number of times update_state_of_system */ 

/* has been called. */ 

extern old_el old_data [NUM_OF_OLD] ; /* temp and humid history */ 



extern char func_needed; /* Function needed by system (humidify, */ 

/* dehumidify, heat, cool) . See main.c for */ 
/* information. */ 
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extern unsigned short hdwr_encode ; /* Encoded 16-bit quantity used to */ 

/* communicate with */ 

/* hardware and indicate what external devices */ 
/* need to do to implement the needed function */ 
/* to the environment. See main.c for more */ 
/* information. */ 

extern int curr_loc; /* location to write old temp and humid */ 

extern direction humid_dir , temp_dir ; /* direction for current_vars */ 



The "main.c" Module 



A Hewlett-Packard Software Product 
Copyright Hewlett-Packard Co. 1992 



All Rights Reserved. Reproduction, adaptation, or translation without prior 
written permission is prohibited, except as allowed under copyright laws. 
****************************************************************************** / 

#include <stdio.h> 
#include <string.h> 
#include "update_sys . h" 

/****************************************************************************** 

* This typedef is also found in demo.h but since demo.h is not included in 

* this file, this declaration appears here by itself. 



-I 



#define SHRINKFACTOR 1.3 
#define LISTLEN NUM_0F_0LD*4+1 
typedef enum {false, true} boolean; 
typedef enum {up, down} direction; 



typedef struct 
{ 



short temp; 

short humid; 

float ave_temp; 

float ave_humid; 
} old_el; 

* Global Variable Declarations 
*******************************/ 



o 1 d_e 1 o 1 d_dat a [ NUM_OF_OLD ] ; 

short target_temp; 

short target_humid; 

char ascii_old_data [LISTLEN] [I 



/* History of temp and humid data. */ 



Target temperature. */ 
Target humidity. */ 



/* ASCII history of temp and humid data. */ 



float float_temp; 

float float_humid; 

float aver_temp; 

short current_temp; 

short current_humid; 



Current temperature. */ 
Current humidity. */ 



int 



num_checks ; 



/* Counts the number of times */ 

/* update_state_of_system ( ) is called */ 
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int curr_loc; /* location to write old temp and humid */ 







f unc_needed 


is the byte 


that indicates what the environment control ; 




needs to do 


to the environment. The following specifies the values 




may have : 








<bit>: 


bit #3 


bit #2 bit #1 bit #0 




<function 






* 

* 


needed> : 


dehumidif y 


humidify cool heat 


* 


The only valid values 


for this char are: 


* 


(hex) 


(binary) 






(1) 


0001 


heat 




(2) 


0010 


cool 


* 


(4) 


0100 


humidify 


* 


(8) 


1000 


dehumidif y 


* 


(9) 


1001 


dehumidify and heat 


* 


(A) 


1010 


dehumidify and cool 




(5) 


0101 


humidify and heat 




(6) 


0110 


humidify and cool 



*****************************************************************************/ 
char func_needed; 

/it***************************************************************************** 

* hdwr_encode is the encoded 16-bit quantity output by the system which is 

* interpreted by external devices. It tells the external devices what to do, 

* for example, turning the air conditioner on (indicated by hdwr_encode = 

* 0010) . There are four sets of four bits within the 16 bit quantity 

* hdwr_encode. These sets of bits are encoded as follows: 
* 

* Value of Value of Value of Value of 

* bits 15 - 12 bits 11-8 bits 7-4 bits 3-0 

* Dehumidifier Humidifier Air Conditioner Heater 

* 0 = off 0 = off 0 = off 0 = off 

* 1 = on 1 = on 1 = on 1 = on 

unsigned short hdwr_encode; 

direction humid_dir, temp_dir; /* direction for current_vars */ 

extern void init_system ( ) ; /* initialize system */ 

extern void update_system ( ) ; /* update system variables */ 

extern void interrupt_sim ( ) ; /* simulate an interrupt */ 

extern void do_sort(); /* sets up ascii array and calls combsort */ 

main ( ) 
{ 

init_system ( ) ; 

while (true) 
{ 

update_system ( ) ; 
num_checks++ ; 

interrupt_sim ( &num_checks ) ; 

} 

} 
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/****************************************************************************** 

* FUNCTION: interrupt_sim 

* PARMS : counter — loop counter passed in from main 

* DESCRIPTION: 

* create a simulation of a (usually) long interrupt service routine that 

* also has a duration profile to use with a SPA duration trigger. 

****************************************************************************** / 
void 

interrupt_sim (counter) 

int ^counter; 

{ 

short outer; 
short inner; 
short limit; 

limit = (^counter % 10) * (^counter % 10) / 3; 

for ( outer = 0; outer < limit; outer++ ) 

for ( inner = 0; inner < 270; inner++ ) 
inner++ ; 

if ( ! ( (*counter ) % 4 ) ) 

do_sort ( old_data, ascii_old_data, limit % NUM_OF_OLD ) ; 

} 

* FUNCTION: strcpy8 

* DESCRIPTION: 

* Copy only 7 chars (8 with NULL) 
* 

int strcpy8 ( dest, src ) 
char *dest; 
char *src; 
{ 

int i; 

/* Copy it */ 

for ( i=0; i < 7 ss *src; i++ ) 

*dest++ = *src++; 
*dest = '\0'; 

} 

* FUNCTION: gen_ascii_data 

* DESCRIPTION: 

* Generate ascii data from binary data 
* 

******************************************************************************/ 
int gen_ascii_data ( data, ascii_data, size ) 
old_el data[]; 
char ascii_data[] [8]; 
int size; 
{ 

int i, j; /* counters */ 

char buf [ 1 6 ] ; 
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} 



/* Place ascii data in the ascii array */ 

for (j=0, i=0; i < size; i++) 

{ 

sprintf ( buf, "%7d", data [ i ]. temp ); 
strcpy8 (ascii_data [ j++] , buf ); 

sprintf ( buf, "%7d", data [ i ]. humid ); 
strcpy8 (ascii_data [ j++] , buf ); 

sprintf ( buf, "%7.2f", data [ i ] . ave_temp ); 
strcpy8 (ascii_data [ j++] , buf ); 

sprintf ( buf, "%7.2f", data [ i ] . ave_temp ); 
strcpy8 (ascii_data [ j++] , buf ); 

} 

strcpy8 (ascii_data [ j++] , "\0" ); 



These variables made static for debugging purposes 
(used by combsort function) 



int len, 


/* 


number of strings to sort */ 


switches , 


/* 


any element switches this pass? */ 


switch_total , 


/* 


total number of switches performed in sort */ 


i, i, 


/* 


loop counters */ 


top, 


/* 


top of current passes in len */ 


passes, 


/* 


number of passes for sort */ 


gap; 


/* 


current gap size */ 



* FUNCTION: combsort 

* DESCRIPTION: 

* A combsort (11) for arrays of ascii data 8 chars wide 
* 

int combsort ( array ) 

char array [ ] [ 8 ] ; 

{ 

char hold[100]; /* temp var for element swap */ 

/* Determine length of array */ 
for (len=0; *array[len] != '\0';) 
len++; 

/* Main sort loop */ 

gap = len; /* set comb gap to len to start */ 

passes = 0; /* pass counter */ 

switch_total = 0; /* total switches */ 

do 



passes++; /* ran another pass */ 

gap = (int) ( (float) gap / SHRINKFACTOR) ; 
switches = 0; /* dirty pass flag */ 



/* Force gap to conform to combll */ 

switch (gap) 

{ 



417 



Chapter 12: Concepts 
Demo Program Description 



case 0: 

case 9: 
case 10: 
case 1 1 : 

default : 
} 



gap = 1; /* smallest gap is 1 = bubble */ 
break; 



gap = 11; /* force comb sort 11 */ 
break; 



break; 



/* Do the comb sort loop for this comb gap */ 

for (top=len-gap, i=0 ; i < top; i++) 

{ 

j = i + gap; /* j is higher than i by gap */ 

if ( st rncmp (array [ i ] , array [j], 7) > 0) 

{ /* swap elements if required */ 

switches++; 

switch_total++ ; 

/* strncpy (hold, array [i], 7); 
strncpy (array [ i ] , array [j], 7); 
strncpy (array [ j ] , hold, 7); */ 
strcpy8 (hold, array[i]); 
strcpy8 (array [ i ] , array[j]); 
strcpy8 (array [ j ] , hold); 



while (switches I I (gap > 1)) 



/* Show sort performance summary data in elements 1, 2, 3 */ 

/* for display memory blocked repetitive */ 

sprintf ( hold, "#Pas%3d", passes ); 

strcpy8 ( array [1], hold ); 

sprintf ( hold, "#Swi%3d", switch_total ); 

strcpy8 ( array [3], hold ); 

sprintf ( hold, "Len%4d", switch_total ); 

strcpy8 ( array [5], hold ); 



/* NOTE: This has been an example of how to monitor complex C variables 
while your program is running. If you issue a 'Mem Bloc ()' 
action key with ' ascii_old_data' in the entry buffer you will 
see a snapshot of your sprintf results. You may also add a 
Display->Memory->Repetitively command to see this dynamically! */ 



* FUNCTION: do_sort 

* DESCRIPTION: 

* Generate ascii data from binary data and sort it 

****************************************************************************** j 
void do_sort ( data, ascii_data, size ) 
old_el data[]; 
char ascii_data[] [8]; 
int size; 
{ 

int i=0; /* counter */ 

char buf [16] ; 



/* Clear the array first */ 

for (i=0; i < NUM_OF_OLD*4 ; i++) 
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strcpy8 (ascii_data [i] , "CLEARED") ; 

/* Generate the array to sort */ 
gen_ascii_data ( data, ascii_data, size ); 

/* Sort the array */ 
combsort ( ascii_data ) ; 

/* Print the floating point average temp also */ 
sprintf ( buf, "Ave%5.2f", aver_temp ); 
strcpy8 (ascii_data [ 7 ] , buf ); 



The "init_system.c" Module 

A Hewlett-Packard Software Product 
Copyright Hewlett-Packard Co. 1992 

All Rights Reserved. Reproduction, adaptation, or translation without prior 

written permission is prohibited, except as allowed under copyright laws. 
******************************************************************************/ 
/it************************************************************************** 

* Function: init_system ( ) 

* Description: Initializes the environmental control system. 

* It is called by main after power up. The variables are 

* initialized within this procedure so that the system can 

* reboot without being reloaded. 

* Parameters: None. 

* References: None. 

* Returns: Nothing. 

* copyright Hewlett-Packard Company 1988 

***************************************************************************/ 
#include "update_sys . h" 

#include "demo.h" 

void init_val_arr ( ) ; 

void 

init_system ( ) 

{ /* FUNCTION init_system ( ) */ 

/* Initialize the target values for temperature and humidity */ 
target_temp = 73; 
target_humid = 45; 

/* Intialize the variables indicating the current environment */ 
/* conditions */ 
current_temp = 68; 
current_humid = 41; 

/* Set starting directions for temp and humid */ 
temp_dir = up; 
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humid_di r = up ; 



/* Initialize the variables that depict the current status of the */ 
/* computer room and what hardware needs to be on or off in the room */ 
func_needed = 0; 
hdwr_encode = 0; 



/^Initialize the count of calls to update_state_of_system ( ) * / 
num_checks = 0 ; 

/* Initialize writing location in old_array */ 
curr_loc = 0; 

/^Initialize the array that save the last cur_temp & cur_humid values*/ 
init_val_arr { ) ; 



/****************************************************************************** 

* Function: init_val_ar r ( ) 

* Description: This code initializes the val_arr data structure. 

* Parameters: none 

* References: None. 
* 

* Returns : Nothing . 

********************************* 
void 

init_val_arr ( ) 
{ 

int cur_el; 

for (cur_el - 0; cur_el < NUM_OF_OLD; cur_el++) 
{ 

old_data [cur_el] .temp - MIN_TEMP; 
old_data [cur_el] .humid - MIN_HUMID; 
old_data [cur_el ] . ave_temp = 0.0; 
old_data [ cur_el ] . ave_humid - 0.0; 

} 

} 



The "update_sys.h" File 

/****************************************************************************** 

A Hewlett-Packard Software Product 
Copyright Hewlett-Packard Co. 1992 



All Rights Reserved. Reproduction, adaptation, or translation without prior 
written permission is prohibited, except as allowed under copyright laws. 







************ 


* * * 


* * * * * 


* * * 


♦define 


HEAT 


0x1 


/* 


0001 


*/ 


#def ine 


COOL 


0x2 


/* 


0010 


*/ 


#def ine 


HUMIDIFY 


0x4 


/* 


0100 


*/ 


#def ine 


DEHUMIDIFY 


0x8 


/* 


1000 


*/ 
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#define FURNACE_ON 0x0001 

♦define AIR_COND_ON 0x0010 

♦define HUMID_ON 0x0100 

♦define DE_HUMID_ON 0x1000 

♦define MAX_TEMP 90 

♦define MIN_TEMP 65 

♦define MAX_HUMID 64 

♦define MIN_HUMID 41 

♦define NUM_OF_OLD 32 

♦define NUM_TO_AVE 16 



void get_targets (short ^temperature, short ^humidity) ; 

void read_conditions (short ^temperature, short ^humidity) ; 

void set_outputs (char *function, short temperature, short humidity); 

void write_hdwr ( char change, unsigned short hdwr_val); 

void save_points ( ) ; 



The "update_sys.c" Module 

/****************************************************************************** 

A Hewlett-Packard Software Product 
Copyright Hewlett-Packard Co. 1992 



All Rights Reserved. Reproduction, adaptation, or translation without prior 
written permission is prohibited, except as allowed under copyright laws. 
****************************************************************************** / 

* Function: update_system ( ) 
* 

* Description: update_system ( ) is the service routine which 

* alters the state of the entire environmental control system. 

* It calls several functions, each of which have a particular part 

* of the system which they alter or update. The following action 

* is taken when this routine is called. 
* 

* 1) New temperature and humidity targets are read in. 

* 2) New environment conditions are read. 

* 3) The func_needed is modified based on the actual state of the 

* environment versus the desired state to indicate what needs to 

* happen in the current environment. 

* 4) func_needed is used to derive hdwr_encode (the 16-bit quantity that 

* indicates what the hardware needs to do to achieve the correct 

* change in the environment) . 

* 5) The environment conditions are saved for posterity. 

* THERE IS A BUG IN THIS ROUTINE (ON PURPOSE!!!) 
* 

* Parameters: None. 

* References : 

* get_targets ( ) 

* read_conditions ( ) 

* save_points ( ) 

* set_outputs ( ) 

* update_system ( ) 

* write_hdwr ( ) 
* 

♦include "update_sys . h" 
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#include "demo.h" 
#include <stdio.h> 

void 

update_system ( ) 
{ 

/* get new targets */ 

get_targets (Starget_temp, Starget_humid) ; 

/* Read the environment conditions. */ 
read_conditions (Scurrent_temp, S current_humid) ; 

/* Set the func_needed based on the actual environment condition 

versus the desired environment condition. */ 
set_outputs (Sfunc_needed, current_temp, current_humid) ; 

/* Update the hdwr_encode value so the external devices can react 

to modify the environment.*/ 
write_hdwr ( f unc_needed, hdwr_encode) ; 

/* Save the current temp and humid for later processing */ 
save_points ( ) ; 



* Function: get_targets ( ) 

* Description: Ramp target temperature and humidity up and down 

* Parameters: 

* temperature - Pointer to target temperature. 

* humidity - Pointer to target humidity. 

* References: None. 

* Returns: Nothing. 

*****************************************************************************/ 
void 

get_targets (short 'temperature, short 'humidity) 
{ 

/* Ramp the temperature and humidity targets up and down */ 

if (temp_dir == up) { 

(♦temperature) +=2; 

if ( 'temperature >= MAX_TEMP) temp_dir = down; 

) 

else ( 

('temperature) — ; 

if ('temperature <= MIN_TEMP) temp_dir = up; 

} 

if (humid_dir == up) { 
('humidity) ++; 

if ('humidity >= MAX_HUMID) humid_dir = down; 

} 
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else { 

( 'humidity) — ; 

if ('humidity <= MIN_HUMID ) humid_dir = up; 

} 



/****************************************************************************** 

* Function: read_conditions ( ) 
* 

* Description: Come up with new temperature and humidity values 

* Uses the last NUM_OF_OLD values and the current target 

* to create the new values. 

* Parameters : 

* temperature - Pointer to current temperature. 

* humidity - Pointer to current humidity. 
* 

* References: None. 

* Returns: Nothing. 

*****************************************************************************/ 
void 

read_conditions (short 'temperature, short 'humidity) 
{ 

int i , temp_tot , humid_tot ; 

temp_tot=0 ; 
humid_tot=0 ; 

for (i=0; i<NUM_TO_AVE; i++) 
{ 

temp_tot += old_data[i] .temp; 
humid_tot += old_data[i] .humid; 

} 

'temperature = (temp_tot /NUM_TO_AVE + target_temp) /2; 
'humidity = (humid_tot /NUM_TO_AVE + target_humid) /2 ; 



**************************************************************************** 
Function: set_outputs ( ) 

Description: Analyzes the environment and is set to indicate what needs 
to happen in the current environment to get the environment backk 
to target conditions. It uses a simple algorithm which simply 
compares the actual temperature/humidity against the desired 
temp/humid. If the temperature/humidity is too high or low then 
the appropriate external device will either be turned on or off. 



Parameters : 

function 

temperature 
humidity 



Pointer to byte indicating how the environment 
needs to change 
Current temperature. 
Current humidity. 



References: None. 



voi 
set 
{ 



Returns: Nothing, 
d 

outputs (char 'function, short temperature, short humidity) 
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if 


(temperature 


<= 


= target_temp) 








^function & 




-COOL; /* Cooling 


off 


*/ 


if 


(temperature 


> 


target_temp) 








^function 




COOL; /* Cooling 


on * 


/ 


if 


(temperature 


> = 


= target_temp) 








^function & 




-HEAT; /* Heating 


off 


*/ 


if 


(temperature 


< 


target_temp) 








*function 




HEAT; /* Heating 


on * 


/ 



if 


(humidity <^ 


= target_humid) 








*f unction 


&= -DEHUMIDIFY; 


/* 


Dehumidify off */ 


if 


(humidity > 


target_humid) 








*f unction 


= DEHUMIDIFY; 


/* 


Dehumidify on */ 


if 


(humidity >^ 


= target_humid) 








*f unction 


&= -HUMIDIFY; 


/* 


Humidify off */ 


if 


(humidity < 


target_humid) 








*f unction 


|= HUMIDIFY; 


/* 


Humidify on */ 



* Function: write_hdwr() 

* Description: Sets the hardware encoded 16-bit quantity to indicate what the 

* hardware needs to do to achieve the changes in the environment 

* that 'change' indicates are needed. 

* Parameters: 

* change - change needed in environment 

* hdwr_val - value of hardware encoded quantity. 
* 

* References: None. 

* Returns: Nothing. 

*****************************************************************************/ 
void 

write_hdwr (char change, unsigned short hdwr_val) 
{ 



if (change S HEAT) 

hdwr_val |= FURNACE_ON; 
if (change S COOL) 

hdwr_val |= AIR_COND_ON; 
if (change S HUMIDIFY) 

hdwr_val |= HUMID_ON; 
if (change S DEHUMIDIFY) 

hdwr_val I = DE_HUMID_ON; 



/* If the value of hdwr_encode should change, change it */ 
if (hdwr_encode != hdwr_val) 
hdwr_encode = hdwr_val; 



* Function: save_points ( ) 

* Description: This code saves the current values of the temperature and 
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* humidity into an array of structures of integers defined to 

* be NUM_OF_OLD in size. The current_temp and current_humid values 

* are then inserted into the array in the next position using 

* curr_loc. Note there is a bug inserted on purpose in this code. 

* "curr_loc" takes on values between 0 and NUM_OF_OLD, which 

* causes writes beyond the end of the array. This causes 

* "target_temp" and "target_humid" to be overwritten every 

* (NUM_0F_0LD+1 ) times the routine is called. 

* Parameters : none 

* References: None. 

* Returns: Nothing, 
void 

save_points ( ) 
{ 

short i; 

short temp_tot , humid_tot ; 

old_data [ curr_loc ] .temp = current_temp; 
old_data [ curr_loc ] .humid = current_humid; 
curr_loc++; 

if (curr_loc > NUM_OF_OLD) curr_loc = 0; /*BUG!!!!!*/ 
temp_tot=0 ; 

for (i = 0; i<NUM_OF_OLD; i + +) 

temp_tot += old_data [ i ] . temp; 

old_data [curr_loc] .ave_temp = ( float ) temp_tot /( float ) (NUM_OF_OLD ) ; 

humid_tot = 0 ; 

for (i = 0; i<NUM_OF_OLD; i + +) 

humid_tot += old_data[i] .humid; 

old_data [curr_loc] . ave_humid = ( float ) humid_tot /( float ) (NUM_OF_OLD) ; 



Building the Demo Program 

The demo program was built using the Hewlett-Packard 8086/186 Advanced C 
Cross Compiler on the HP 9000 Series 300 host computer with the following UNIX 
make file. 
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The "Makefile" File 

################################################################################ 
# 

# This Makefile is used to build the demonstration software for the 

# Hewlett-Packard i8086 Debug Environment. 
# 

# Before initiating a make in the installation demo directory: 

# $HP64000/demo/debug_env/hp6476x, the contents of this directory should 

# be moved to a local directory to keep the installation directory intact. 
# 

# 

.SUFFIXES: . x 

# 

# The compiler used is the Hewlett-Packard i8086 Advanced C Cross Compiler. 

# 

CC = $ (HP64000) /bin/cc8086 

AS = $ (HP64000) /bin/as86 

LD = $ (HP64000) /bin/ld86 

SHELL=/bin/sh 

CFLAGS = -I. -LM -hN 

ASFLAGS = -f mod086 

LDFLAGS = -c Linkcom.k -L -h 

# 

# If the command "make" is given with no target, the default will make 

# ecs.X using HP language tools 

# 

TARGET = ecs.X 

C_SRC = main.c init_system . c update_sys.c 
C_OBJ = $ (C_SRC: .c=.o) 

TEST_OBJ = $(C_OBJ) $ (ASM_OBJ) 

default : 

make $ (TARGET) 

# 

# Targets of Makefile 

# 

help : 

@echo "" ; \ 



echo 
echo 
echo 
echo 
echo 
echo 
echo 
echo 



Targets for Makefile:"; \ 
" ; \ 

ecs.X - create demo program executable ecs.X, using HP"; \ 

language tools"; \ 
clean - remove all object files"; \ 

" ; \ 

You must execute V'make clean\" before switching ecs.* targets"; \ 



# Basic Rules 

. c . o : 

$ (CC) $ (CFLAGS) -c $*.c 

. s . o : 

$(AS) $ (ASFLAGS) $*.s 
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# Other Entry Points 

clean : 

rm -rf *.o *.L *.X *.A *.Y *.0 *.M * . Ys *.MAP *.x 

# 

ecs.X: $(TEST_OBJ) 

$(LD) $ (LDFLAGS) -o ecs.X $ (TEST_OBJ) >ecs.MAP 

init_system . o : update_sys . h demo.h 

main.o: update_sys . h 

update_sys . o : update_sys.h demo.h 



The "Linkcom.k" Linker Command File 

; This is a linker command file for the HP i80x8x C Cross Compiler. It 
; may be used in conjunction with the emulation configuration files 
; in this directory: 
; Config.EA and Configall.EA 

; LARGE MEMORY MODEL with I/O using emulator hp6476x 

* To initialize data in segment "idata" at run-time remove the comment 

* character {*) before INITDATA and comment out (or remove) the 

* "LOAD ... init_stub.o" line. 
* INITDATA idata 

list x 

LOAD /usr/hp64 000/env/hp64 7 6x/large/init_stub. o 

LOAD /usr/hp64 000/env/hp64 7 6x/large/crtl . o 

LOAD /usr/hp64 000/env/hp64 7 6x/large/div_by_0 . o 

LOAD /usr/hp64 000/lib/80 8 6/large/libm. a 

LOAD /usr/hp64 000 /lib/808 6/large/libc . a 

LOAD /usr /hp64 000 /lib/808 6 /large /lib. a 

LOAD /usr/hp64 000/env/hp64 7 6x/large/env. a 

LOAD /usr /hp64 000 /lib/808 6/large/libc. a 

LOAD /usr /hp64 000 /lib/808 6 /large /lib. a 

LOAD /usr/hp64 000/env/hp64 7 6x/large/env.a 

SEC envdata=010000H 

SEC /CODE=080000H 

ORDER 

envdata, libdata, libcdata,data,idata,udata,heap,userstack, /CODE, libcconst, libmconst, /??INI 

T, mm_check, const 

END 



To build the demo program: 

$ make <RETURN> 



427 



Chapter 12: Concepts 
Demo Program Description 



Creating a Symbol File 

You can typically use symbol table information from a linker map file when 
creating the ASCII symbol file. For example, you can edit the "ecs.MAP" file to 
create the following "ecs.awk" file. 



DIV_F32A_L 


f divO 1 


lib 


08063 : 


: 00076 


DIV_F64A_L 


ddivO 1 


lib 


08063 : 


r\ r\ ~i r\ rt 

: 00708 


DIV_I32A_L 


ldiv03 


lib 


08063 : 


: 005E0 


DIV_I32B_L 


ldiv04 


lib 


08063 : 


: 0052 9 


DIV_UI32A_L 


IdivO 1 


lib 


080 63 : 


: 00585 


DP ADD L 


dpopns 


lib 


08 0 63 : 


: 0 0A68 


DPDIV_L 


dpopns 


lib 


08063 : 


: 00731 


DPMUL_L 


dpopns 


lib 


08063 : 


: 0 0 8FB 


DPRD IV_L 


dpopns 


lib 


08063 : 


r\ r\ ~7 o a 

; U 0 / Z 4 


Err Handler 


ErrHndl r 


lib 


08063 : 


: 0005B 


F 3 2_T0_F 6 4_L 


cast 0 8 


lib 


08063 : 


: 00E70 


F32_TO_I32_L 


cast 02 


lib 


08063 : 


: 00 631 


F 3 2_T0_U 1 3 2_L 


cast 02 


lib 


08063 : 


: 00 60D 


T7 1 tZ A Tr\ TIC T 

r t}4 1U lib h 


cast 02 


lib 


0 8 0 63 : 


■ n n c ^ a 
. u U b 0 h 


F64_TO_I32_L 


cast 02 


lib 


080 63 : 


: 00 63F 


T7 tZ A Tr\ TIT 1 £ T 
r D 4 1 U U 1 1 O J-i 


cast 02 


lib 


0 8 0 63 : 


: 00 626 


TT Z. A TT\ T T T ^ 9 T 
r b^± 1U U-LJZ J_i 


cast 0 2 


1 i u 
1 ID 


IfoU O J . 


. u u b Id 


FPADD_L 


f popns 


lib 


08063 : 


: 0028 6 


rrUl V J_i 


f popns 


lib 


UoUoj . 


. u u u y y 


h PMUL L 


f popns 


lib 


080 63 : 


: 0 0 1D4 


r PKD 1 V Li 


f popns 


lib 


nnn/rri . 

U o U Do . 


. u u u y z 


TIC T/~\ TP 9 O T 

1 1 b 1 U r o Z J_i 


cast 0 3 


lib 


UoUDj . 


. nrn?/i n 




c rt 1 


envdat a 


fii flfifl , 
UiUUU . 


■ r\r\r\r\r\ 
. uuuuu 


MM_C H E C K_X 


crt 1 


envdat a 


01000 : 


r\ r\ r\ r\ r\ 

: 00000 


MOD_1 3 2 A_L 


lmod03 


lib 


080 63 : 


: 0053F 


MUD U 1 3 2 A L 


imodU 1 


lib 


080 63 : 


: 005 68 


MOM T TOR MF^^AOF 




ri t 7 H .a +" a 
trii V LAO. L. a. 


01000 : 


■ nnnn a 

. \J \J \J VJrt 


MON_STK_PTR 


crtl 


envdata 


01000: 


:00000 


MUL_I32A_L 


lmulOl 


lib 


08063: 


: 0051B 


MUL_I32B_L 


lmul02 


lib 


08063: 


: 00505 


TOP_OF_STACK 


stackheap 


userstack 


01165 : 


: 07F00 


UI16_TO_F32_L 


cast 03 


lib 


08063 : 


: 00E3C 


USER_ENTRY 


mon_stub 


env 


0819C: 


: 0013F 


USR_STACK 


stackheap 


userstack 


01165 : 


: 00002 


XEnv_8 6_except 


disp_msg 


envdata 


01000 : 


: 00008 


HEAP_PTR 


crtl 


envdata 


01000: 


:00004 


TOP_OF_HEAP 


stackheap 


heap 


01065: 


: 01001 


USR_HEAP 


stackheap 


heap 


01065: 


:00002 


clear_f p_status 


set_get 


lib 


08063: 


:00034 


ctype 


ctype 


libcconst 


0841E: 


: 002DC 


db l_t o_s t r 


dbl_t o_st r 


libc 


081DC : 


: 018F5 


display_message 


disp_msg 


env 


0819C: 


: 000C3 


div_by_0_t rap 


div_by_0 


env 


0819C: 


: 0008E 


doprnt 


doprnt 


libc 


081DC: 


: 0017F 


er r_handler 


ErrHndlr 


lib 


08063: 


: 00055 


exec_f uncs 


atexit 


libc 


081DC: 


:00048 


exit 


crtl 


env 


0819C: 


:00083 


exit_msg 
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: 002B4 
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You can use the UNIX awk programming language to reformat the information in 
the symbol table so that it's in the proper format: 

# 

: global_symbol 
module : local_symbol 



# 

To generate a file close to being in the proper symbol file format: 

$ awk ' {printf "%s:%s %s\n", $2, $1, $4}' ecs.awk | sort > ecs.sym 
<RETURN> 

You must edit the resulting "ecs.sym" file to make some minor formatting 
corrections, like adding the "#" lines to the top and bottom of the file. 
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Installation Guide 

Instructions for installing and configuring the product. 
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Installation at a Glance 
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Equipment supplied 

The minimum system contains: 

• HP 64767 A/B/C PGA Emulator Probe (which includes the demo target 
system). 

• HP 64748C Emulation Control card. 

• HP 64706A 48-Channel Emulation Bus Analyzer card. 

• HP 64700 Card Cage. 

Optional parts are: 

• HP 64703 A 64-Channel Emulation Bus Analyzer and 16-Channel External 
State/Timing Analyzer (instead of HP 64706A). 

• HP 64704A 80-Channel Emulation Bus Analyzer (instead of HP 64706A). 

• HP 64794A 80-Channel Deep Memory Emulation Bus Analyzer (instead of 
HP 64706A). 

Equipment and tools needed 

In order to install and use the 80186 emulation system, you need: 

• Host computer or terminal with RS-232/RS-422 port. 

• RS-232/RS-422 cable. 

• Flat-blade screwdriver. 

Installation overview 

The following steps in the installation process are described in this chapter: 

1 Connect the emulator probe cables. 

2 Install emulation control and analyzer boards into the HP 64700 Card Cage. 

3 Connect the HP 64700 Card Cage to a host computer or terminal. 

4 Connect the emulator probe to the demo target system. 

5 Apply power to the HP 64700 . 

6 Verify emulator and analyzer performance. 

Your emulation and analysis system may already be assembled (depending on how 
parts of the system were ordered), and you may only need to connect the HP 64700 
to a host computer or terminal and the target microprocessor system. 
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Antistatic precautions 

Integrated-circuit boards contain electrical components that are easily damaged by 
small amounts of static electricity. To avoid damage to the emulator cards, follow 
these guidelines: 

• If possible, work at a static-free workstation. 

• Handle the boards only by the edges; do not touch components or traces. 

• Use a grounding wrist strap that is connected to the HP 64700' s chassis. 

The probe is shipped with a block of anti-static foam. This foam should be 
removed from the probe before use. 
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Step 1. Connect the Emulator Probe Cables 



Three ribbon cables connect the HP 64748C emulation control card to the HP 64767 80186/8 emulator 
probe. 

The shortest cable connects from Jl of the emulation control card to J3 of the emulator probe. The 
medium length cable connects from J2 of the emulation control card to J2 of the emulator probe. The 
longest cable connects from J3 of the emulation control card to J 1 of the emulator probe. 



1 Connect the emulator probe cables to the emulation control card. 
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Step 1 . Connect the Emulator Probe Cables 



2 When inserting cable connectors into the sockets, press inward on the connector clips so that they hook 
into the sockets as shown. 
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Step 1 . Connect the Emulator Probe Cables 



3 Connect the other ends of the cables to the emulator probe. 
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Step 2. Install Boards into the HP 64700 Card 
Cage 



WARNING Before removing or installing parts in the HP 64700 Card Cage, make sure 

that the card cage power is off and that the power cord is disconnected. 



CAUTION Do NOT stand the HP 64700 on the rear panel. You could damage the rear panel 

ports and connectors. 



If your emulator and analyzer boards are already installed in the HP 64700 Card Cage, go to "Step 3a. 
Connect the HP 64700 via RS-232/RS-422" or "Step 3b. Connect the HP 64700 via LAN". 
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1 Use a ground strap when removing or installing boards into the HP 64700 Card Cage to reduce the 
chances of damage to the circuit cards from static discharge. A jack on the rear panel of the HP 64700 
Card Cage is provided for this purpose. 
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3 Remove the side cover by unsnapping the two latches and lifting off. 




4 Remove the card supports. 
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Step 2. Install Boards into the HP 64700 Card Cage 



5 First, completely loosen the four egress thumb screws. 

To remove emulator cards, insert a flat blade screwdriver in the access hole and eject the emulator cards 
by rotating the screwdriver. 




A\ ; -iwiE :A'5LE AS A\ ASSE v 'iL v 
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6 Insert a screw driver into the third slot of the right side of the front bezel, push to release catch, and 
pull the right side of the bezel about one half inch away from the front of the HP 64700. Then, do the 
same thing on the left side of the bezel. When both sides are released, pull the bezel toward you 
approximately 2 inches. 



IN5ERT SCREW DRIVER INTO THIRD 
SLOT OF FRONT BEZEL, POSH 
TO RELEASE CATCH AND 

POLL BEZEL TOWARD Y00 ■ . FRONT PANEL 

WITH00T BEZEL 
SHOWING CATCH 
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8 If you're removing an existing analyzer card that provides external analysis, remove the right angle 
adapter board by turning the thumb screws counter-clockwise. 
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9 To remove the analyzer card, insert a flat blade screwdriver in the access hole and eject the analyzer 
card by rotating the screwdriver. 




EJECT ANALYZER CARD 



Do not remove the system control board. This board is used in all HP 64700 emulation and analysis 
systems. 
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10 Install Emulation Bus Analyzer and HP 64748C boards. The Emulation Bus Analyzer is installed in 
the slot next to the system controller board. The HP 64748C is installed in the second slot from the 
bottom of the HP 64700. These boards are identified with labels that show the model number and the 
serial number. 

To install a card, insert it into the plastic guides. Make sure the connectors are properly aligned; then, 
press the card into mother board sockets. Check to ensure that the cards are seated all the way into the 
sockets. If the cards can be removed with your fingers, the cards are NOT seated all the way into the 
mother board socket. 




EMULATION 
CONTROL 
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11 Connect the +5 V power cable to the connector in the HP 64700 front panel. 
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15 Install the top cover in reverse order of its removal, but make sure that the side panels of the top cover 
are attached to the side clips on the frame. 
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Step 3a. Connect the HP 64700 via RS-232/RS-422 

If you wish to connect the HP 64700 to a host computer via the LAN interface, go to "Step 3b. Connect 
the HP 64700 via LAN". 



1 Set the data communications configuration switches so that the HP 64700 port will have characteristics 
compatible with the terminal or host computer interface to which it will be connected (see the following 
switch summary tables). Note that the configuration switch settings are only read when the HP 64700 is 
powered ON or when the ink -p command is entered. 

The locations of the data communications ports and configuration switches are shown below. 




453 



Chapter 13: Installation 

Step 3a. Connect the HP 64700 via RS-232/RS-422 



HP 64700B Configuration Switch Summary 

The information in the following table is also on an adhesive label attached to each 
HP64700B. 



Configuration Switches S1-S8 



SI 



S2 



S3 



RS-232/RS-422 Baud Rate 



1 


1 


1 


= 230400 


1 


1 


0 


= 115200 


1 


0 


1 


= 38400 


1 


0 


0 


= 57600 


0 


1 


1 


= 1200 


0 


1 


0 


= 2400 


0 


0 


1 


= 19200 


0 


0 


0 


= 9600 



NOTES: 



SI - S3: 



S4: 



S6: 



S7: 



S4 

1 = 

DTE 



S5 
1 = 

RS-422 



0 = 
DCE 



0 = 
RS-232 



S6 

1 = 

Service 



0 = 
Normal 



S7 
1 = 

Service 



0 = 
Normal 



S8 
1 = 

Reserved 
for future 
use 



0 = 
Normal 



Asynchronous baud rates include 300, 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 
1 15200. The rear panel switches can be used to initialize at 1200, 2400, 9600, 19200, 
38400, or 1 15200 baud. Rates of 300 baud and 4800 baud are only selectable through the 
Terminal Interface stty command. This entire range of rates are supported at RS-422 signal 
levels. The EIA-RS232-D standard only covers data rates up to 20,000 bits per second 
(actual 19200). Asynchronous connections using RS-232 signal levels above this rate can 
be used but cannot be guaranteed. 

Isosynchronous rates of 230400 baud and 460800 baud are supported at RS-422 signal 
levels using a IX clock. The rate of 230400 can be selected through the rear panel switches 
but 460800 is only selectable through the stty command. 

DCE = Data Communications Equipment, DTE = Data Terminal Equipment. This switch is 
ignored if S5 sets the serial port to be an RS-422 device (which is always DCE). 

When this switch is set to " 1 ", self diagnostic information is displayed by a flashing LED 
on the control board during the powerup cycle. This information is intended to be used by a 
qualified service technician only. 

When this switch is set to "1 ", the HP 64700B firmware is forced to execute from ROM 
instead of Flash EPROM. This mode is intended to be used by a qualified service 
technician only. 
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Configuration Switches S9-S16 



S9 


S10 


Sll 


S12 


S13 


S14 


S15 


S16 


1 = 


1 = 


1 = 


1 = 


1 = 


1 = 


1 = 


1 = 


7 Bit 
character 
size 


Parity 
enabled 


Parity even 


RTS/CTS 
DSR/DTR 


XON/ 
XOFF 


LAN 
BOOTP 
enabled 


15 pin AUI 


LAN 


0 = 


0 = 


0 = 


0 = 


0 = 


0 = 


0 = 


0 = 


8 Bit 
character 
size 


Parity 
disabled 


Parity odd 


NoHW 
handshake 


NoSW 
handshake 


LAN 
BOOTP 
disabled 


BNC 
ThinLAN 


Serial 



NOTES: 



g22- Hardware pacing uses a modified handshake. When hardware handshake is enabled, the 

DTE uses Clear to Send (CTS) to control its output. When CTS is true, data may be output, 
when CTS is false, data output will stop at the end of the current character. The DCE is 
expected to negate CTS during receipt of a character if the internal hardware buffer is full. 
Once a position is available in the internal hardware buffer, CTS is to be set true. 

A modification is made in the use of Request to Send (RTS) as a reverse channel Clear to 
Send to control the output of the DCE. The DTE sets RTS false during the receipt of a 
character if there is no room in its hardware buffer. The DCE must stop transmission of 
data at the conclusion of the current character and wait until the DTE sets RTS true before 
resuming transmission. 

This modified RTS/CTS handshake protocol provides full bi-directional hardware 
handshaking of the data streams. The HP 64700B can support baud rates up to 460800 
using this protocol. 

§12- Software pacing uses XON/XOFF protocols (DC1/DC3). Upon receipt of an XOFF, the 
HP 64700B can continue to transmit up to 3 additional characters. The HP 64700B sends 
an XOFF when its internal buffer can accept only 64 additional bytes before overflow. 
Software pacing is only valid on the transmission of ASCII data streams. It is not supported 
for binary transfers. It will support a maximum baud rate of 57600. Above this rate 
hardware handshaking must be used to prevent data loss. 
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2 Select and connect the RS-232/RS-422 cable. 

To connect cables to the HP 64700, simply align the cable with the serial port and insert the 25-pin male 
connector of the cable until it is firmly seated. You should then tighten the holding screws on each side 
of the cable with a small flat blade screwdriver. This will ensure that the cable pins and shield hood 
make good contact with the HP 64700 connector and will also guard against accidental disconnection of 
the cable. 




TIGHTEN W/ 

SMALL FLAT BLADE SCREWDRIVER 
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Step 3b. Connect the HP 64700 via LAN 



1 Enable the LAN interface. If you are using the HP 64700' s LAN interface, you must enable it by 
setting switch S16 is set to one (1). Set all other switches (SI through S13) to zero. 




LAN 



2 Select the BNC or 15-pin AUI port. S15 is used to select which of the HP 64700's LAN connectors 
will be used: either the BNC connector (S15 = 0) or the 15-pin AUI connector (S15 =1). 



BNC 
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3 Enable or disable BOOTP. 

BOOTP is a network service running on a host computer that allows the HP 64700' s LAN parameters to 
be set automatically when the emulator is powered up. 

When S14 is set to (1) and the host computer's "bootptab" table file has been modified to include 
information for the HP 64700, BOOTP will be used to set the HP 64700' s LAN parameters when the 
emulator is powered up. 

When S14 is set to zero (0), BOOTP is disabled and LAN parameters must be set by connecting the 
HP 64700 to a terminal or host computer via the serial port (as described in the previous Step 3a) and use 
the Terminal Interface lan command to set the HP 64700' s LAN parameters. Once the LAN parameters 
are set (they are saved in EEPROM), you can change the configuration switch settings and connect the 
HP 64700 to the LAN. 



BOOTP BOOTP 
ENABLE DISABLED 




458 



Chapter 13: Installation 
Step 4. Plug the emulator probe into the demo target system 



Step 4. Plug the emulator probe into the demo 
target system 



1 With HP 64700 power OFF, connect the emulator probe cables to the demo target system. You may 
need to remove the foam block from the pins of the probe. 

Take care to locate the "extra" corner pin of the header at the corresponding pin of the emulator probe. 

The flying lead(s) must be correctly installed or damage to the emulator probe will result. Match the 
white dot on the flying lead cable plug with the white dot on the probe (ground). Match the "signal" 
(undetachable) side of the cable with the *BG or *RST pin on the demo board. 
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Step 4. Plug the emulator probe into the demo target system 



2 Connect the power supply wires from the emulator to the demo target system. The 3 -wire cable has 1 
power wire and 2 ground wires. When attaching the 3-wire cable to the demo target system, make 
sure the connector is aligned properly so that all three pins are connected. 
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Step 5. Apply power to the HP 64700 



The HP 64700B automatically selects the 1 15 Vac or 220 Vac range. In the 1 15 Vac range, the 

HP 64700B will draw a maximum of 345 W and 520 VA. In the 220 Vac range, the HP 64700B will 

draw a maximum of 335 W and 600 VA. 

The HP 64700 is shipped from the factory with a power cord appropriate for your country. You should 
verify that you have the correct power cable for installation by comparing the power cord you received 
with the HP 64700 with the drawings under the "Plug Type" column of the following table. 

If the cable you received is not appropriate for your electrical power outlet type, contact your 
Hewlett-Packard sales and service office. 
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Power Cord Configurations 



Plug Type 


Cable Part No. 


Plug Description 


Length in/cm 


Color 


Opt 903 




8120-1378 


Straight 


90/228 


Jade Gray 


124V ** 














a* 


8120-1521 


90° 


90/228 


Jade Gray 


Opt 900 




olZU-1 jj 1 


Straight 


on/9 os 

VU/ZZo 


Gray 


250V 






*BS136A 










8120-1703 


90° 


90/228 


Mint Gray 


Opt 901 




8120-1369 


Straight 


79/200 


Gray 


250V 
















8120-0696 


90° 


87/221 


Mint Gray 


Opt 902 




812001689 


Straight 


79/200 


Mint Gray 


250V 






* CEE7-Y1 1 










8120-1692 


90° 


79/200 


Mint Gray 








Straight 










8120-2857 


(Shielded) 


79/200 


Coco 












Brown 


* Part number shown for plug is industry identifier for plug only. 




Number shown for cable is HP part number for complete cable including plug. 




** These cords are included in the CSA certification approval for the equipment. 
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Power Cord Configurations (Cont'd) 



Plug Type 


Cable Part No. 


Plug Description 


Length in/cm 


Color 


Opt 906 
250V 


8120-2104 
8120-2296 


Straight 
* SEV1011 
1959-24507 
Type 12 
90° 


79/20 
79/200 


Mint Gray 
Mint Gray 


Opt 912 
220V 


8120-2957 


Straight 
*DHCK107 

90° 


79/200 
79/200 


Mint Gray 
Mint Gray 


Opt 917 
250V 


8120-4600 
8120-4211 


Straight 
SABS 164 
90° 


79/200 
79/200 


Jade Gray 


Opt 918 
100 V 


8120-4753 
8120-4754 


Straight Miti 
90° 


90/230 
90/230 


Dark Gray 


* Part number shown for plug is industry identifier for plug only. 

Number shown for cable is HP part number for complete cable including plug. 

** These cords are included in the CSA certification approval for the equipment. 
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1 Connect the power cord and turn on the HP 64700. 



The line switch is a push button located at the lower left hand corner of the front panel. To turn ON 
power to the HP 64700, push the line switch button in to the ON (1) position. The power light at the 
lower right hand corner of the front panel will be illuminated. 




464 



Chapter 13: Installation 
Step 5. Apply power to the HP 64700 



When the emulator powers up, it sends a message (similar to the one that follows) to the selected 
command port and then displays the Terminal Interface prompt. You can verify that your data 
communications configuration is at least partially functional by looking for the message and prompt on 
the controlling device (terminal or terminal emulation program running on a host computer). 

Copyright (c) Hewlett-Packard Co. 1987 
All Rights Reserved. Reproduction, adaptation, or translation without prior 
written permission is prohibited, except as allowed under copyright laws. 

HP64700B Series Emulation System 
Version: B.01.00 20Dec93 
Location: Flash 
System RAM:1 Mbyte 

HP64767A (PPN: 64767A) Intel 80C186EA Emulator 
HP64740 Emulation Analyzer 
R> 
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If the HP 64700 does not provide the Terminal 
Interface prompt 

When using the RS-232/RS-422 interface: 

If the HP 64700 does not provide the Terminal Interface prompt to the controlling 
device when power is applied: 

□ Make sure that you have connected the emulator to the proper power source and 
that the power light is lit. 

D Make sure that you have properly configured the data communications switches on 
the emulator and the data communications parameters on your controlling device. 
You should also verify that you are using the correct cable. 

The most common type of data communications configuration problem involves 
the configuration of the HP 64700 as a DCE or DTE device and the selection of the 
RS-232 cable. If you are using the wrong type of cable for the device selected, no 
prompt will be displayed. 

When the serial port is configured as a DCE device, a modem cable should be used 
to connect the HP 64700 to the host computer of terminal. Pins 2 and 3 at one end 
of a modem cable are tied to pins 2 and 3 at the other end of the cable. 

When the serial port is configured as a DTE device, a printer cable should be used 
to connect the HP 64700 to the host computer of terminal. Pins 2 and 3 at one end 
of a printer cable are swapped and tied to pins 3 and 2, respectively, at the other end 
of the cable. 

If you suspect that you may have the wrong type of cable, try changing the S4 
setting and cycling power. 
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If the HP 64700 does not provide the Terminal Interface prompt 

When using the LAN interface: 

You must use the telnet command on the host computer to access the HP 64700. 
After powering up the HP 64700, it takes a minute before the HP 64700 can be 
recognized on the network. After a minute, try the telnet <internet address> 
command. 

If telnet does not make the connection: 

□ Make sure that you have connected the emulator to the proper power source and 
that the power light is lit. 

□ Make sure that the LAN cable is connected. Refer to your LAN documentation for 
testing connectivity. 

□ Make sure that the HP 64700' s Internet Address is set up correctly. You must use 
the RS-232/RS-422 port to verify this that the Internet Address is set up correctly. 
While accessing the emulator via the RS-232/RS-422 port, run performance 
verification on the LAN interface with the lanpv command. See "To run PV on the 
LAN interface". 

If telnet makes the connection, but no Terminal Interface prompt is supplied: 

D It's possible that the HP 64000 software is in the process of running a command 
(for example, if a repetitive command was initiated from telnet in another window). 
You can use <CTRL>c to interrupt the repetitive command and get the Terminal 
Interface prompt. 

D It's also possible for there to be a problem with the HP 64700 firmware while the 
LAN interface is still up and running. In this case, you must cycle power on the 
HP 64700. 
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To run PV on the LAN interface 

1 Connect a host computer or terminal to the HP 64700 using the RS-232 interface. 

The HP 64700 LAN interface can be tested through a Terminal Interface command 
called lanpv. You can only use this command when communicating with the 
HP 64700 over an RS-232 connection. Do not use this command when 
communicating with the HP 64700 over the LAN. 

2 Disconnect the HP 64700 from the LAN and terminate the HP 64700' s LAN port 
you want to test. 

Before you run the test, the HP 64700 must be disconnected from the network. 

The connector you wish to test must be completely terminated, and the other 
connector must not be terminated. Only one connector can be tested at a time. 

To properly terminate the BNC port, place a BNC "T" connector on the port and 
place 50 ohm terminators on each end of the T-connector. 

To properly terminate the 15-pin AUI port, leave the MAU attached to the port and, 
using the appropriate loopback hood or loopback connector, terminate the end of 
the MAU that is normally connected to the LAN. 

3 Access the Terminal Interface and enter the lan -va command to test the 15 -pin 
AUI connector or the lan -vb command to test the BNC connector. 

This command will return "PASSED" or "FAILED" before issuing a prompt. For 
example, to test the BNC connector: 

R> lanpv -vb 

Testing: HP 64700B LAN interface (BNC connector) 
PASSED 
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Step 6. Verify emulator and analyzer performance 

The emulator probe must be plugged into to the demo target system when you run 
the performance verification tests. 

After the emulator probe is plugged into the demo target system (make sure the 
power lines from the emulator are connected to the demo target system), power has 
been applied to the HP 64700, and the HP 64700 has supplied the Terminal 
Interface prompt to the controlling device, you can run performance verification 
tests on the emulator and analyzer. 

1 Type the "pv" command, along with the number of times you want to execute the 
command. 

For example: 

R>pv l 



Testing: HP64767A (PPN: 64767A) Intel 80C186EA Emulator 
PASSED 

Number of tests: 1 Number of failures: 0 

Testing: HP64740 Emulation Analyzer 
PASSED 

Number of tests: 1 Number of failures: 0 

Copyright (c) Hewlett-Packard Co. 1987 
All Rights Reserved. Reproduction, adaptation, or translation without prior 
written permission is prohibited, except as allowed under copyright laws. 

HP64700B Series Emulation System 
Version: B.01.00 20Dec93 
Location: Flash 
System RAM : 1 Mbyte 

HP64767A (PPN: 64767A) Intel 80C186EA Emulator 
HP64740 Emulation Analyzer 

R> 
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If performance verification fails 

□ Make sure the emulator probe cables are connected to the demo target system 
correctly (see Step 4) and that the power lines from the emulator are connected to 
the demo target system. 

• You must use the 69-pin double header between the emulator and the demo 
board. 

• Both flying leads (LBG and LRES) from the probe must be connected to the 
demo board. (On some older boards, only the LBG lead is available.) 

□ Make sure the emulator and analyzer boards have been installed into the HP 64700 
Card Cage correctly (see Step 2) and that there are no bent or broken pins on any of 
the connectors. 

If this does not seem to solve the problem, call the nearest Hewlett-Packard Sales 
and Service office listed in the Support Services manual. 
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Installing/Updating Emulator Firmware 



If you ordered the HP 64767 80186/8/XL/EA/EB/EC emulator probe and the 
HP 64748C emulation control card together, the control card contains the correct 
firmware for the HP 64767. 

However, if you ordered the HP 64767 and the HP 64748C separately, or if you are 
using a HP 64748C that has been previously used with a different emulator probe, 
you must download the firmware for the HP 64767 into the emulation control card. 

The firmware, and the program that downloads it into the control card, are included 
with the 80186/8 emulator probe on the following MS-DOS format floppy disks: 

• 801 86/8/XL/E A/EB/EC EMULATION FIRMWARE 64767 

• 64700 SWUTIL 

The steps to install or update the emulator firmware are: 

1 Connect the HP 64700 card cage to an IBM PC AT compatible computer's 
RS-232 serial port. 

2 Install the firmware update utility and the 64767 emulator firmware. 

3 Run "progflash" to update emulator firmware. 
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Step 1 . Connect the HP 64700 to a PC host 
computer 



1 Set the HP 64700 data communications configuration switches. 

Set all "COMM CONFIG" (communications configuration) switches on the rear panel of the HP 64700 
to the zero or open position. 


/Afi ' ^ 





Note that switch settings are read ONLY after the HP 64700 is powered up. Any changes made to the 
switches after power-up will not be read until you turn the HP 64700 off and back on again. 
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2 Connect the RS-232 cable. 

Recommended cables are HP 13242N (25-pin male to 25-pin male) or HP 24542M (9-pin female to 
25-pin male) which are equivalent to a MODEM cable. 

To connect cables to the HP 64700, simply align the cable with port A and insert the 25-pin male 
connector of the cable until it is firmly seated. You should then tighten the holding screws on each side 
of the cable with a small flat blade screwdriver. This will ensure that the cable pins and shield hood 
make good contact with the HP 64700 connector and will also guard against accidental disconnection of 
the cable. 




TIGHTEN W/ 

SMALL FLAT BLADE SCREWDRIVER 
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Step 2: Install the firmware update utility 

Your HP Vectra PC or IBM PC AT compatible computer must have MS-DOS 3. 1 
or greater and a fixed disk drive. The firmware update utility and the 64767 
firmware require about 300 Kbytes of disk space. 

1 Insert the 64700 SW UTIL disk into drive A. 

2 Change MS-DOS prompt to drive A: by typing "A:" at the MS-DOS prompt. 

For example: 

C> A: <RETURN> 
A> 

3 Type "INSTALL" at the MS-DOS prompt. 
For example: 

A> INSTALL <RETURN> 

After confirming that you want to continue with the installation, the install program 
will give you the option of changing the default drive and/or subdirectory where the 
software will reside. The defaults are: 

Drive = C: 

Directory Path = C:\HP64700 

Follow the remaining instructions to install the firmware update utility and the 
64767 firmware. These instructions include editing your CONFIG.SYS and 
AUTOEXEC .BAT files. Details foUow in the next steps. 

4 After completing the install program, use the PC editor of your choice and edit the 
\CONFIG.SYS file to include these lines: 

BREAK=ON 
FILES=20 
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BREAK=ON allows the system to check for two break conditions: 
<CTRLxBreak>, and <CTRL>c. 

FILES=20 allows 20 files to be accessed concurrently. This number must be at 
LEAST 20 to allow the firmware update utility to operate properly. 

5 Edit the AUTOEXEC.BAT file to add: 

C:\HP64700\BIN (to the end of the PATH variable) 
SET HP TABLE S=C : \HP 64 7 0 0 \TABLES (as a new line) 
SET HPBIN=C: \HP64700\BIN (as a new line) 

Part of an example AUTOEXEC.BAT file resembles: 

ECHO OFF 

SET HP TABLE S=C : \HP 64 7 0 0 \TABLES 
PATH=C: \DOS;C: \HP64 700\BIN 

6 If you are using the COM3 or COM4 ports, you will need to edit the 
\HP64700\TABLES\64700TAB file. The default file contains entries to establish 
the communications connection for COM1 and COM2. The content of this file is: 

EMUL_C0M1 unknown COM1 OFF 9 60 0 NONE ON 1 8 
EMUL_COM2 unknown COM2 OFF 9 60 0 NONE ON 1 8 

Either add another line or modify one of the existing lines. For example: 

EMUL_COM3 unknown COM3 OFF 9 60 0 NONE ON 1 8 
EMUL_COM4 unknown COM4 OFF 9 60 0 NONE ON 1 8 

The "unknown" field usually specifies the processor type (which is "i80186" for the 
HP 64767 emulator), but you don't need to change this field in order to update the 
emulator firmware. 



Software installation is now complete. The PC will need to be rebooted to enable 
the changes made to the CONFIG.SYS and AUTOEXEC.BAT files. To reboot, 
press the <CTRLxALTxDEL> keys simultaneously. 
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Step 3: Run "progflash" to update emulator 
firmware 

• Enter the PROGFLAS [-V] [EMUL_NAME] [PRODUCTS ...] command. 

The PROGFLAS command downloads code from files on the host computer into 
Flash EPROM memory in the HP 64700. 

The -V option means "verbose". It causes progress status messages to be displayed 
during operation. 

The EMUL_NAME option is the logical emulator name as specified in the 
\HP64700\TABLES\64700TAB file. 

The PRODUCTS option names the products whose firmware is to be updated. 

If you enter the PROGFLAS command without options, it becomes interactive. If 
you don't include the EMUL_NAME option, PROGFLAS displays the logical 
names in the \HP64700\TABLES\64700TAB file and asks you to choose one. If 
you don't include the PRODUCTS option, PROGFLAS displays the products 
which have firmware update files on the system and asks you to choose one. (In 
the interactive mode, only one product at a time can be updated.) You can abort the 
interactive PROGFLAS command by pressing <CTRL>c. 

PROGFLAS will print "Flash programming SUCCEEDED" and return 0 if it is 
successful; otherwise, it will print "Flash programming FAILED" and return a 
nonzero (error). 

You can verify the update by displaying the firmware version information. 
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Examples To install or update the HP 64767 emulator firmware in the HP 64700 that is 

connected to the COM1 port: 

C> PROGFLAS <RETURN> 



HP64700S006 A. 00. 04 24Feb92 
64700 SW UTIL 

A Hewlett-Packard Software Product 
Copyright Hewlett-Packard Co. 1991 



All Rights Reserved. Reproduction, adaptation, or translation without prior 
written permission is prohibited, except as allowed under copyright laws. 

RESTRICTED RIGHTS LEGEND 

Use , duplication , or disclosure by the Government is subject to 
restrictions as set forth in subparagraph (c) (1) (II) of the Rights 
in Technical Data and Computer Software clause at DFARS 52.227-7013. 
HEWLETT-PACKARD Company , 3000 Hanover St. , Palo Alto, CA 94304-1181 

Logical Name Processor 

1 EMUL_C0M1 unknown 

2 EMUL_COM2 unknown 

Number of Emulator to Update? (intr (usually cntl C or DEL) to abort) 

To update firmware in the HP 64700 that is connected to the COM1 port, enter "1". 

Product 
1 64767 

Number of Product to Update? (intr (usually cntl C or DEL) to abort) 

To update the HP 64767 80186/8 emulator firmware, enter "1". 

Enable progress messages? [y/n] (y) 



To enable status messages, enter "y". 
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Checking System firmware revision... 
Mainframe is a 64700B 

Reading configuration from ' /hp64700/update/64767 . cf g' 

ROM identifier address = 2FFFF0H 

Required hardware identifier = 1FFFH, 1FF4H 

Control ROM start address = 280000H 

Control ROM size = 40000H 

Control ROM width = 16 

Programming voltage control address = 2FFFFEH 
Programming voltage control value = FFFFH 
Programming voltage control mask = OH 

Rebooting HP64700... 
Checking Hardware id code... 
Erasing Flash ROM 

Downloading ROM code: /hp64 700 /update/ 64 7 67 . X 

Code start 280000H (should equal control ROM start) 

Code size 27BF4H (must be less than control ROM size) 
Finishing up . . . 

Rebooting HP64700... 

Flash programming SUCCEEDED 

C> 

You could perform the same update as in the previous example with the following 
command: 

C> PROGFLAS -V EMUL_C0M1 64 7 67 <RETURN> 
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Glossary 



access mode Specifies the types of cycles used to access target system memory 
locations. For example a "byte" access mode tells the monitor program to use 
load/store byte instructions to access target memory. 

active emulator probe An emulator probe that contains circuitry that allows the 
emulator to more closely imitate the electrical characteristics of the microprocessor 
thereby avoiding the timing problems that can occur with passive probes. 

analyzer An instrument that captures data on signals of interest at discreet 
periods. 

background The emulator mode in which foreground operation is suspended so 
the emulation processor can be used for communication with the emulation 
controller. The background monitor does not occupy any processor address space. 

background emulation monitor An emulation monitor program that does not 
execute as part of the user program, and therefore, operates in the emulator's 
background mode. 

background memory Memory space reserved for the emulation processor 
when it is operating in the background mode. Background memory does not take 
up any of the processor's address space. 

display mode When displaying memory, this mode tells the emulator the size of 
the memory locations to display. When modifying memory, the display mode tells 
the emulator the size of the values to be written to memory. 

embedded microprocessor system The microprocessor system that the 
emulator plugs into. 

emulation bus analyzer The internal analyzer that captures emulator bus cycle 
information synchronously with the processor's clock signal. 

emulation monitor program A program that is executed by the emulation 
processor which allows the emulation controller to access target system resources. 
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For example, when you display target system memory locations, the monitor 
program executes microprocessor instructions that read the target memory locations 
and send their contents to the emulation controller. 

emulator An instrument that performs just like the microprocessor it replaces, but 
at the same time, it gives you information about the operation of the processor. An 
emulator gives you control over target system execution and allows you to view or 
modify the contents of processor registers, target system memory, and I/O 
resources. 

foreground The mode in which the emulator is executing the user program. In 
other words, the mode in which the emulator operates as the target microprocessor 
would. 

foreground emulation monitor An emulation monitor program that operates 
in the foreground emulator mode, and therefore, executes as if it were part of the 
user program. 

global restart When the same secondary branch condition is used for all terms in 
the analyzer's sequencer, and secondary branches are always back to the first term. 

prestore The analyzer feature that allows up to two states to be stored before 
normally stored states. This feature is useful when you want to find the cause of a 
particular state. For example, if a variable is accessed from many different places in 
the program, you can qualify the trace so that only accesses of that variable are 
stored and turn on prestore to find out where accesses of that variable originate 
from. 

primary sequencer branch Occurs when the analyzer finds the primary branch 
state specified at a certain level and begins searching for the states specified at the 
primary branch's destination level. 

real-time Refers to continuous execution of the user program without 
interference from the emulator. (Such interference occurs when the emulator 
temporarily breaks into the monitor so that it can access register contents or target 
system memory or I/O.) 

secondary sequencer branch Occurs when the analyzer finds the secondary 
branch state specified at a certain level before it found the primary branch state and 
begins searching for the states specified at the secondary branch's destination level. 



Glossary 



sequence terms Individual levels of the sequencer. The analyzer provides 8 
sequence terms. 

sequencer The part of the analyzer that allows it to search for a certain sequence 
of states before triggering. 

sequencer branch Occurs when the analyzer finds the primary or secondary 
branch state specified at a certain level and begins searching for the states specified 
at another level. 

target system The microprocessor system that the emulator plugs into. 

trace A collection of states captured on the emulation bus (in terms of the 
emulation bus analyzer) or on the analyzer trace signals (in terms of the external 
analyzer) and stored in trace memory. 

trigger The captured analyzer state about which other captured states are stored. 
The trigger state specifies when the trace measurement is taken. 
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Index 



abbreviated help mode, 244 
absolute count (in trace list), 133, 295 
absolute file 

formats, 233, 250 

loading into memory, 88, 250-251 

loading via ftp, 89 
accent grave mark character, 235, 273 
access mode, 259, 481 
access to guarded memory, 257 
accuracy of trigger position, 312 
active edges (slave clock), 325 
activity, analyzer line, 282 
addr (predefined trace label), 137 
all (analyzer keyword), 338, 340, 349 
altitude, operating and non-operating environments, 407 
analyzer, 481 

analyzer initialization, 306-307 

arming other HP 64700 Series analyzers, 5 

breaking emulator execution into the monitor, 5 

breaking execution of other HP 64700 Series emulators, 5 

clock (master) specification, 287-289 

complex config. pattern qualifier, 314-315 

complex config. range qualifier, 317-318 

configuration, 285-286 

count qualifier, 290-291 

definition, 4 

general description, 4 

halt trace, 301-302 

labels, 310-311 

line activity, 282 

master clock specification, 287-289 
performance verification, 261 
prestore qualifier, 316 
primary branches (sequencer), 303-305 
sequencer, 327-329 



sequencer secondary branch qualifiers, 292-294 
slave clocks, 324-326 
start, 281 

storage qualifiers, 330-331 

trace labels, predefined equates for, 137 

trace list, 308-309 

trace list format, 295-296 

trace status, 319-323 

tracing background operation, 288 

tracing foreground operation, 288 

trigger condition, 297-298 

trigger output, 299-300 

trigger position, 312-313 

using the, 120 
analyzer input lines and signal names, 135 
analyzer probe 

assembling, 178 

connecting to the target system, 180 
and, interset logical AND operator, 241 
any (analyzer keyword), 338, 340, 349 
arm condition 

analyzer status, 320 

specifying, 204, 283-284 

time until trigger, 321 
arming the analyzer, 283-284 
ASCII strings, displaying on standard output, 235 
AUTOEXEC.BAT file, 475-476 

b (break execution into monitor) command, 33, 98, 214 
background, 481 

cycles, tracing, 123 

emulation monitor, 481 

execution, tracing, 288 

memory, 71, 481 
background monitor, 71 

selecting, 72-73 
bases (number), 333 

default for step count, 271 

labels in trace list, 295 
baud rates, serial port, 454 

be (break conditions) command, 107-109, 215-216 
BGND output line, 59 



binary trace list format, 309, 338 

block, re-assignment of emulation memory, 257 

BNC 

connector, 5, 194 

trigger signal, 196, 215, 217-218 
bnct (BNC trigger drivers and receivers) command, 217-218 
BOOTP, 458 
bootptab file, 458 

bp (breakpoint modify) command, 103, 219-220 
branch qualifiers (sequencer) 

primary, 147, 149, 162, 303-305 

secondary, 147, 150, 162, 292-294 
break, 214 

effect of processor prefetch, 216 

write to ROM, 107 
break conditions, 107-109 

after initialization, 85 

analyzer trigger, 108 

BNC or CMB trigger signals, 215 

guarded memory access, 257 

software breakpoints, 215 

synchronous, 227 

trigl or trig2 internal signals, 215 

write to ROM, 215 
breakpoints 

after initialization, 85 

software, 101-106 

cables 

data communications, 456, 474 
emulator probe, length, 406 
power, 461 

calculator for expressions, 235 

cautions 

antistatic precautions, 436 

BNC accepts only TTL voltage levels, 199 

CMB 9-pin port is NOT for RS-232C, 197 

emulator suspension rating of 29.5 kg, 406 

make sure of BGND output pin alignment, 59 

powering OFF the HP 64700, 56 

protect emulator against static discharge, 55 

pv command re-initializes emulator, 261 



rear panel, do not stand HP 64700 on, 440 
cf (emulator configuration) command, 221-223 
cf mon command, 73 
cf rrt command, 69 
channels (analyzer) 

demultiplexed slave clock mode, 325 

edge trigger, 338 

glitch trigger, 340 

mixed slave clock mode, 325 

transition record, 349 
character length, 455 
characteristics, emulator, 402-407 
characterization of memory, 24, 78 

cim (copy target system memory image) command, 117, 224 
cl (command line editing) command, 49, 225-226 
clock speed, maximum qualified, 186 
clocks 

master, 189 

qualifying, 188 

See also slave clocks 

specification, 185 

specifying analyzer master, 287-289 
specifying analyzer slave, 324-326 
CMB (coordinated measurement bus), 194 
enable/disable, 227 
EXECUTE line, 196 
HP 64700 connection, 197 
READY line, 195 
signals, 195 

start synchronous execution, 337 

trace at /EXECUTE, 332 

TRIGGER line, 195 

trigger signal, 215, 229-230, 332 
cmb (enable/disable CMB interaction) command, 201, 227-228 
cmbt (CMB trigger drivers/receivers) command, 229-230 
CMOS (keyword for specifying threshold voltages), 181 
column headers in trace list 

adding new columns, 295 

suppressing, 308 
command files 

LAN, using over, 52 



command syntax, 41 
commands 

cf mon, 73 

cfrrt, 69 

combining on a single command line, 47 
command line editing, 49 
groups, viewing help for, 41 
help, 244 

help for group, 244 
macros, 254-255 

maximum length of command line, 255 
recall, 48 

repeating a group of, 268 

repetitive execution, 50 

sym, 278-280 
communications (data) 

initialization, 245 

setting parameters, 275-277 
communications configuration switch summary, 454 
communications ports, 453-456, 473-474 

electrical characteristics, 405 

physical characteristics, 406 
complex analyzer configuration 

definition, 162 

pattern specifications, 314-315 

range specification, 317-318 
complex expressions, 241 
CONFIG.SYS file, 475-476 
configuration 

analyzer, 285-286 

background monitor selection, 72 

data communications switches, 275 

emulator, 221-223 

See emulator configuration 

foreground monitor selection, 75 

monitor selection, 73 

restrict to real-time runs, 69 
configuration switches, HP 64700B 

summary, 454 
constants, 333 
control (CTRL) characters 



c, command abort, 251, 261, 268, 271 

non-displaying, 236 
coordinated measurements 

definition, 194 

enable/disable, 227-228 
copy memory, 231 
count (occurrence), 297, 303, 322 

reset if secondary branch taken, 293 
count qualifier, 144, 290-291 
counter, analyzer tag, 290 
counts, displaying relative or absolute, 133 
cp (copy memory) command, 116, 231 
cross-triggering, 217, 227 
customized foreground monitors, 75 

data (predefined trace label), 137 
data communications 

cable selection, 456, 474 

configuration switches, 275 

initialization, 245 

location of ports, 453 

setting port parameters, 275-277 

switch settings, 453 

switch summary, 454 
data cycles, monitor access to target memory, 259 
date, setting emulation system, 232 
DCE device, setting serial port as a, 454 
delay (trigger), external timing analyzer, 348 
deleting sequencer terms, 328 
delimiters (string), 235, 273 
delta time, binary/hexadecimal trace list, 342 
demo program 

emulator, 21 
DeMorgan's law, 160, 241 
demultiplexing 

mixed clocks mode, 189 

true demultiplexing mode, 190 

using slave clocks for, 189-190, 325 
dimensions, emulator, 406 
disassembly, trace list, 32, 295 
display mode, 259, 481 
downloading absolute files, 5, 88, 250-251 



drivers and receivers 

BNC trigger signal, 217-218 
CMB trigger signal, 229-230 
See also trigl and trig2 internal signals 

dt (set or display system date/time) command, 232 

DTE device, setting serial port as a, 454 

dual-port emulation memory, 69 

dump (upload memory) command, 233-234 

duration (external timing trigger), 346 

easy configuration, definition, 162 

echo (display to standard output) command, 235-236 

ECL (keyword for specifying threshold voltages), 181 

edge trigger (external timing analyzer), 338-339 

edges (analyzer clock), rising, falling, both, 288 

edges (analyzer slave clock), active, 325 

electrical characteristics of the emulator, 402 

embedded microprocessor system, 481 

emulation break, 214 

emulation bus analyzer, 481 

emulation memory 

after initialization, 86 

dual-port, 69 
emulation monitor, 33, 481 

break command, 214 

breaks to the, 215 

cycles used to access target memory, 259 
execute after reset, 269 
foreground or background, 71-77 
function of, 71 

searching target memory, 274 
emulator, 482 
dimensions, 406 
electrical characteristics, 402 
environmental characteristics of, 407 
error messages, 355-356 
general description, 4 
initialization, 245-246 
multiple start/stop, 5, 201-202 
performance verification, 261 
physical characteristics, 406 
plugging into a target system, 54 



probe cable length, 406 

prompt, changing the, 260 

specifications and characteristics, 402-407 

status, 239 

status characters, 87 

using the, 84 

weight, 406 
emulator configuration 

after initialization, 85 

on-line help for, 41 
emulator configuration items 

loc, 73-74 

mon, 72-73 

proc, 68 

rad, 70 

rrt, 69 
emulator features 

breakpoints, 101-106 

restrict to real-time runs, 69 

single-step processor, 98 
emulator limitations, external DMA support, 78 
emulator probe 

active, 481 

cable length, 406 

pin alignment, 62-65 

target system connection, 55-66 
environment variables 

HPBIN, 476 

HPTABLES, 476 

PATH, 476 

environmental characteristics of the emulator, 407 

equ (equate names to expressions) command, 137, 237-238 

equates, 237-238 

predefined for trace labels, 137 
eram, mapper parameter for emulation RAM, 24, 78, 256 
erom, mapper parameter for emulation ROM, 24, 78, 256 
error messages, 354 

analyzer, 386-399 

emulator, 355-356 

general and system error/status, 360-385 
es (emulator status) command, 36, 87, 239 



EXECUTE (CMB signal), 196, 227, 320, 332, 337 
expression calculator, 235 
expression operators, 333 
expressions, 134 

analyzer, complex configuration, 241 

equating names to, 237-238 

in the complex configuration, 158-161 
external analyzer, 133 

clock specification, 185 

extension to emulation analyzer, 183 

general description, 4 

independent state analyzer, 184-192 

independent state commands, 184 

independent timing analyzer, 176 

mode, 343-344 

probe threshold voltage, 351 

selecting the mode, 183-184 

setup and hold times, 125, 188 

slave clocks, 189-190 

specifications, 408 

timing analyzer mode, 342 

timing mode unavailable in Terminal Interface, 176 
using, 176 
external timing analyzer 
edge trigger, 338-339 
glitch mode, 342 
glitch trigger, 340-341 
mode, 342 
sample period, 345 
standard mode, 342 
transition trigger, 349-350 
transitional mode, 342, 349 
trigger condition, 346-347 
trigger delay, 348 

fast (F) analyzer clock speed, 288 
file formats, absolute, 25, 88, 233, 250 
firmware update utility 

installation, 475-476 
firmware updates, 5 
foreground, 482 

emulation monitor, 482 
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execution, tracing, 288 

memory, 71 
foreground monitor, 71 

advantages/disadvantages, 72 

customizing, 75 

example of using, 76 

selecting, 73, 75 

using a customized, 75 
formats 

absolute file, 233, 250 

binary trace list, 309 

memory display, 247, 252 

trace list, 133, 295-296 

ftp 

loading absolute files, 89 
loading symbol files, 93 

G glitch (external timing analyzer) mode, 342 

glitch trigger (external timing analyzer), 340-341 

global access and display modes, 259 

global restart qualifier, 146-147, 292, 297, 304, 328, 482 

global set operators, 160 

global storage qualifier, 330 

grabbers, connecting to analyzer probe, 179 

grave mark character, 235, 273 

grd, mapper parameter for guarded memory, 78, 257 

ground strap, 55 

group (command), 244 

guarded memory access, 78, 257 

H halt 

trace, 129, 301-302 

trace status, 320 
handshake mode, 276 
headers in trace list 

adding new columns, 295 

suppressing, 308 
help, 244 

abbreviated mode, 244 

information on system prompts, 87 

using, 41 
history, trace status, 321 
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hold times for external analyzer, 125, 188 
HP 64037 RS-422 Interface Card, 5 
HP 98659 RS-422 Interface Card, 5 
HPBIN environment variable, 476 
HPTABLES environment variable, 476 

I independent state mode of external analyzer, 343-344 
information (help), 244 

init (emulator initialization) command, 23, 85, 245-246 
initialization 

analyzer, 121, 306-307 

emulator, 85, 245-246 

emulator, -c option, 86 

emulator, -p option, 86 

emulator, -r option, 86 

emulator, limited, 85 
input lines and signal names for analyzer, 135 
inserting sequencer terms, 328 
installation, 433 

internal signals, trigl and trig2, 215, 217, 229, 283, 301, 332 
interrupts, 72 

interset operators, 160, 241 
intraset operators, 160, 241 

inverse values (complex analyzer expressions), 242 
IP address, 26, 89 

J J clock (analyzer), 287, 325 

K K clock (analyzer), 287, 325 

L L clock (analyzer), 287, 325 
labels (trace) 

defining analyzer, 310-311 

predefined, 310 
LAN connection, 457-458 

loading absolute files, 89 

loading symbol files, 93 
LAN interface, 457-458, 468 

BOOTP enable/disable, 458 

enabling, 457 

port selection, 457 
limited initialization, 85 
line activity (analyzer), 282 
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list, trace, 130 

load (load absolute file) command, 250-251 

user monitor, 75 
load symbols command, 92 

loc (monitor location) emulator configuration item, 73 
locating the monitor program, 73 

logical run address, conversion from physical address to, 70 

m (memory display/modify) command, 29, 115, 252-253 

M clock (analyzer), 287, 325 

mac (macro definition/display) command, 254-255 

macros 

after initialization, 85 

limitations, 255 

using, 51 

map (memory mapper) command, 24, 79, 256-258 
mapping memory, 24, 78-82, 256-258 
master clocks (analyzer), 189, 287-289 
maximum 

command line length, 255 

sequence levels in easy configuration, 304 

sequence terms in easy configuration, 327 

trace state storage, 342 
measurements 

analyzer, starting, 281 

coordinated, 227-228 
memory 

assess mode, 259 

characterization of, 24, 78 

display mode, 259 

displaying, 252-253 

dual-port emulation, 69 

loading programs into, 88, 250-251 

map after initialization, 85 

mapping, 24, 78-82, 256-258 

mnemonic format display, 114 

modifying, 252-253 

re-assignment of emulation memory blocks in mapper, 82 
search, 273-274 
upload to host file, 233-234 
memory mapper 
block size, 78 



resolution, 78 
memory mapper, resolution, 256 
messages 

error, 354 

status, 360-385 
mixed (slave clock) mode, 189, 325 
mnemonic, information in the trace list, 295 
mo (set access and display modes) command, 259 
mode 

abbreviated help, 244 

demultiplexed slave clock, 325 

external analyzer, 343-344 

external timing analyzer, 342 

glitch (external timing analyzer), 342 

memory access, 259 

memory display, 259 

mixed slave clock, 325 

quiet, 251, 271 

standard (external timing analyzer), 342 
transitional (external timing analyzer), 342, 349 
whisper, 271, 319 
monitor (emulation) 
break command, 214 
breaks to the, 215 

comparison of foreground/background, 72 
cycles used to access target memory, 259 
execute after reset, 269 
foreground monitor location, 73 
foreground or background, 71-77 
function of, 71 

searching target memory, 274 
selecting, 73 
selecting background, 72 
selecting foreground, 75 
multiple emulator start/stop, 5 

N clock (analyzer), 287, 325 
names 

pattern, 314 

values, 237-238 
NAND operator, 242 
never (analyzer keyword), 338, 340, 349 



no trace data (message), 308 

none (analyzer keyword), 290, 338, 340, 349 

NOR, intraset logical operator, 241 

notes 

absolute files, loading in the wrong format, 251 
analyzer count qualifier cannot be arm condition, 290 
analyzer drives and receives same signal, 206 
analyzer range resource, only one available, 135 
analyzer, "tcq time" only if "tck -s S", 290 
asterisk (*) in help command, 244 
bit range is relative to label, 339, 341, 350 
breakpoint display status checking, 220 
breakpoint locations must contain opcodes, 101 
CMB EXECUTE and TRIGGER signals, 196 
dashes (-) when specifying command parameters, 250 
data communications references, 277 
date and time are reset when power is cycled, 232 
date assumes year is in 20th century, 232 
display mode and memory modification, 253 
dump creates non-standard HP absolute files, 234 
emulation memory block re-assignment, 257 
equate limits, 237 

equates, new values not updated in commands, 237 

equates, when values are assigned, 138 

external analyzer probe setup/hold times, 343 

foreground monitors that cause breaks, 75 

init -c, -r, or -p cause system memory loss, 245 

map change requires breakpoint disable, 257 

master clock qualifiers: tck -u, tck -b, 289 

memory map modification causes emulator reset, 257 

occurrence counts in complex configuration, 303 

operations carried out on 32-bit numbers, 334 

primary and secondary branch qualifiers satisfied, 292, 304 

range reset when trace configuration reset to easy, 317 

re-assignment of emulation memory blocks by mapper, 82 

rx command enables CMB interaction, 227 

search patterns, specifying complex, 274 

sequence term count reset, 293 

sequencer term 8 default, 293, 304 

single open quote, ASCII character, 235, 273 

step command doesn't work when CMB enabled, 202 
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step count must be specified with address, 271 
step does not work correctly while CMB enabled, 272 
string delimiter character should not be in string, 235 
strings should not contain string delimiter character, 273 
trace format does not affect information captured, 296 
trace list command options, mutually exclusive, 309 
trace states, displaying when trigger not found, 301 
xon toggling with baud rates of 1200 or below, 276 
xtarm does not allow "!=" when in timing mode, 284 

number bases, 333 

numbers, software version, 335 

numeric search in memory, 273 

O occurrence count, 140, 297, 303, 322 

reset if secondary branch taken, 293 
on-line help, using the, 41 
operators 

combining intraset and interset, 241 

expression, 333 

interset, 160, 241 

intraset, 160, 241 
or, interset logical OR operator, 241 
OR, intraset logical operator, 241 
other, mapper parameter for unmapped memory, 256 
output line, BGND, 59 
overlap, trace labels, 311 

P pi - p8, trace pattern labels, 314 

parameters, data communications, 275-277 
parity 

error detection, 455 

reasons for setting, 455 

switch settings for, 455 

types of (odd/even), 455 
PATH environment variable, 476 
patterns (trace), 158 

limitations of combining, 160 

names, 314 

qualifying, 158, 314-315 

performance verification, 261, 469 
failure, what to do in case of, 470 
LAN interface, 468 
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physical characteristics of the emulator, 406 

physical run address, conversion to logical run address, 70 

pipeline, analyzer architecture, 321 

plug-in, 54 

po (set or display prompt) command, 260 
polarity, trace labels, 310 
ports (data communications) 

setting parameters, 275-277 
position of trigger state in trace, 312-313 
power cables 

connecting, 461 

correct type, 461 
powerup initialization, 245 
predefined equates for trace labels, 137 
predefined trace labels, 136, 310 
prefetch, effect on break, 216 
prestore qualifier, 142, 316, 482 
prestore string, 143 

primary branches (analyzer sequencer), 147, 149, 303-305, 482 
difference between easy and complex configuration, 162 

probe 

emulator, 261 

external analyzer, clock channels, 287, 325 

external analyzer, setup/hold times, 343 

external analyzer, threshold voltages, 351 
progflash example, 478 
program counter symbol ($), 262 
prompts, 87 

changing, 260 

es (emulator status) command, 87 

help information on, 87 
protocol (transfer), 233, 250, 309 
protocol checking, 251 
pv (performance verification) command, 261 

qualified clock speed, maximum, 186 
qualifiers 

analyzer clock, 185 

analyzer count, 144, 290-291 

analyzer master clock, 287-289 

analyzer pattern, 314-315 

analyzer prestore, 142, 316 



analyzer range, 317-318 

analyzer slave clock, 189-190 

analyzer storage, 142, 330-331 

external timing edge trigger, 338-339 

external timing glitch trigger, 340-341 

global restart, 292, 297, 304, 328 

sequencer primary branch, 147, 303-305 

sequencer secondary branch, 147, 292-294 

simple trigger, 139 
question mark (?) 

break conditions display, 216 

on-line help command, 244 
quick start information, 19 
quiet mode, 251, 271 
quote marks, 235, 260, 273 

r (run user program) command, 30-31, 97, 262 

rad (physical run address default) emulator config. item, 70 

RAM, mapping emulation or target, 78 

range (trace), 159 

range qualifier (complex analyzer config.), 317-318 
READY (CMB signal), 195, 227, 337 
real-time runs, 482 

commands not allowed during, 69 

commands which will cause break, 69 

restricting the emulator to, 69 
recall, command, 48 
receivers and drivers 

BNC trigger signal, 217-218 

CMB trigger signal, 229-230 

See also trigl and trig2 internal signals 
record checking, 233 
record, transition, 349 

reg (register display/modify) command, 34, 110-111, 263-267 

registers, displaying, 110-111 

relational expressions, 241 

relative counts in trace list, 133, 296 

rep (repeat commands) command, 50, 268 

repeating commands, 268 

reset 

break during, 214 

breakpoints, 219 



commands which cause exit from, 100 

emulation microprocessor, 269 

emulator, due to mapper modification, 257 

init command, 245 

occurrence count, 293 

range qualifier and trace configuration, 317 

run from, 97, 262 

sequencer, 327 

system date and time, 232 

trace specification, 306-307 

trace tag counter, 290 
resolution, memory mapper, 78, 256 
restart (global) qualifier, 292, 297, 304, 328 
restrict to real time runs, 69 

target system dependency, 69 
ROM 

debug of target, 117 

mapping emulation or target, 78 

writes to, 78, 215 
rrt (restrict to real-time) emulator configuration item, 69 
RS-232 

serial port as RS-232 device, 454 
RS-232 (data communications), 277 
RS-422 

host computer interface card, 5 

serial port as RS-422 device, 454 
rst (reset emulation processor) command, 36, 269 
run address, conversion from physical address, 70 
run from reset, 97 
rx (run at execute) command, 201 

s (step the emulation processor) command, 35, 98, 271-272 
sample period (external timing analyzer), 345 
secondary branch expression, 147, 150, 482 

difference between easy and complex configuration, 162 
selecting background emulation monitor, 72 
selecting emulation monitor, 73 
selecting foreground emulation monitor, 75 
semicolon (command separator), 254 
sequencer (analyzer), 327-329, 483 

adding or inserting terms, 153 

branch, 483 



complex configuration, 162-173 
default specification, 146 

default specification in the complex configuration, 163 
deleting terms, 154, 328 

difference between easy and complex configuration, 162 

primary branches, 303-305 

resetting, 148, 163 

secondary branch qualifiers, 292-294 

simple trigger specification, 148 

terms, 146, 483 

terms, deleting, 328 

using, 146-154 
ser (search memory for values) command, 116, 273-274 
serial port 

DCE device, 454 

DTE device, 454 

RS-422 device, 454 
setup times for external analyzer, 125, 188 
signal considerations, 402 
signal names and input lines for analyzer, 135 
signals 

analyzer clocks, 287, 325 

analyzer, defining labels for, 310-311 

arm, 321 

BNC trigger, 215, 217-218 
CMB, 195 

CMB /EXECUTE, 227, 269, 320, 332, 337 

CMB READY, 227, 337 

CMB trigger, 215, 229-230 

external analyzer, threshold voltages, 351 

internal trigl and trig2, 215, 283, 301, 332 

trigger output, 299-300 
simple trigger 

in the complex configuration, 165 

in the easy configuration, 139 
single-byte interrupt (SBI), 101 
single-step emulation processor, 271-272 
slave clocks (analyzer), 189-190, 324-326 

demultiplexed mode, 325 

mixed mode, 325 
slow (S) analyzer clock speed, 288, 290 



software breakpoints, 101-106, 219-220 

break condition enable/disable, 215 

permanent, 103 

pv command effect on, 261 

temporary, 103 
software version numbers, 335 
specifications 

emulator, 402-407 

external analyzer, 408 
standard (external timing analyzer) mode, 342 
startup, tracing a program on, 127 
stat (predefined trace label), 137 
states (trace) 

maximum with/without count, 290 

prestore, 316 

status, 321 

visible, 321 

static discharge, protecting the emulator probe against, 55 
status 

analyzer, 31, 319-323 

characters (emulation), 87 

emulator, 30, 33, 36, 239 
status, trace, 128 
storage qualifier, 142, 330-331 

difference between easy and complex configuration, 162 
string delimiters, 235, 273 
string search in memory, 273 

stty (set data communications parameters) command, 275-277, 454 

summary of data communication switches, 454 

switch (data communications configuration) setting, 275, 453 

baud rate, 454 

character length, 455 

LAN interface, 457-458 

parity checking, 455 

parity type, 455 

serial port as DCE/DTE device, 454 

serial port as RS-232/RS-422 device, 454 
switches, data communications configuration, 275 
sym (define/display/delete symbols) command, 91, 94, 96, 278-280 
symbol file 

loading, 91 



loading via ftp, 93 
symbol names, creating, 237-238 
symbols, 91 

$, program counter, 262 

*, trace status, 323 
synchronous runs and breaks, 227, 337 
system clock, 232, 261 
system date/time, 232 

t (start trace) command, 31, 127, 281 

ta (trace activity display) command, 121, 282 

tag counter (analyzer), 290 

target system, 483 

plugging the emulator into, 54 

processor signal considerations, 402 

RAM and ROM, 24, 78 

reset, running from, 97 
target system dependency on executing code, 69 
tarm (trace arm condition) command, 204, 283-284 
tcf (set easy/complex configuration) command, 157, 285-286 
tck (specify master clock) command, 287-289 
tcq (specify count qualifier) command, 290-291 
tcq (trace count qualifier) command, 144 

telif (secondary branch expression) command, 147, 150, 292-294 

in the complex configuration, 162 
telnet, LAN connection, 467 

temperatures, operating and non-operating environments, 407 

Terminal Interface, 454 

terms 

analyzer sequencer, 327 

memory mapper, 257 
tf (specify trace list format) command, 295-296 
tf (trace format) command, 133 
tg (simple trigger) command, 31, 139, 297-298 

in the complex configuration, 165 
tgout (trigger output) command, 108, 206, 299-300 
th (trace halt) command, 129, 301-302 

listing traces, 308 
threshold voltages (external analyzer), 181, 351 
tif (primary branch expression) command, 147, 149, 303-305 

in the complex configuration, 162 
time (analyzer keyword), 290 



time, setting emulation system, 232 
timing analyzer 

See external timing analyzer 
tinit (trace initialization) command, 121, 306-307 
tl (trace list) command, 32, 130, 308-309 
tlb (define labels for analyzer lines) command, 310-311 
tokens, 135 

tp (trigger position) command, 141, 312-313 
tpat (trace patterns) command, 158, 314-315 
tpq (trace prestore qualifier) command, 142, 316 

in the complex configuration, 168 
trace, 483 

clock specification, 185 

count qualifier, 144 

displaying activity, 121 

halting the, 129 

listing format, 133 

listing the, 130 

patterns (in complex configuration), 158 

prestore qualifier, 142 

range (in complex configuration), 159 

starting the, 127 

storage qualifier, 142 

trigger output, 206 

trigger position, 141 
trace configuration 

complex or easy, 162 

selecting complex, 157 

selecting easy, 157 
trace labels, 135, 310-311 

defining external, 182 

predefined, 136, 310 

predefined equates for, 137 
trace list, 308-309 

format, 295-296 

header suppression, 308 
trace status, 128, 319-323 

tram, mapper parameter for target RAM, 24, 78, 256 

transfer memory to host file, 233-234 

transfer utility, 233, 250, 309 

transition record (external timing analyzer), 349 



transitional (external timing analyzer) mode, 342, 349 

trigl and trig2 internal signals, 108, 204, 215, 217, 229, 283, 301, 332 

trigger, 31, 483 

analyzer, break on, 108 

condition, 147, 297-298 

cross-triggering, 227 

delay (external timing analyzer), 348 

difference between easy and complex configuration, 162 

driving signals when found, 206 

easy configuration, 147 

edge (external timing analyzer), 338-339 

external timing analyzer, 346-347 

glitch (external timing analyzer), 340-341 

not in memory, 308 

position, 141, 312-313 

position, accuracy of, 141 

sequence term, 285 

simple complex configuration specification, 165 

specifying a simple, 139 
trigger term, 162, 168 
TRIGGER, CMB signal, 195 
trng (trace range) command, 159, 317-318 

trom, mapper parameter for target ROM, 24, 78, 256 
ts (trace status) command, 31, 128, 319-323 

arm information, 128 

occurrence left information, 128 

sequence term information, 128 
tsck (specify slave clocks) command, 324-326 
tsq (trace sequencer specification) command, 327-329 

in the complex configuration, 162 
tsto (trace storage qualifier) command, 142, 330-331 

in the complex configuration, 162 
TTL (keyword for specifying threshold voltages), 181 
tx (trace on CMB /EXECUTE) command, 201, 332 

undefined breakpoint error, 220 
upload memory to host, 233-234 
uploading memory, 5 
user program, 482 
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V values, 333-334 

equating with names, 237-238 

in trace expressions, 137 
ver (display software version numbers) command, 46, 335 
verifying performance, 261 
very fast (VF) analyzer clock speed, 288, 290 
voltages, threshold, 181, 351 

W w (wait) command, 336 

wait (in command sequence), 336 

warnings, power must be OFF during installation, 440 

weight of the emulator, 406 

whisper mode, 271, 319 

windows of activity, using the analyzer to trace, 169 

X x (start synchronous CMB execution) command, 202, 337 
xt (start trace) command, 281 
xtarm (specify arm condition) command, 283-284 
xtcf (set easy/complex configuration) command, 285-286 
xtck (external analyzer clock) command, 185, 287-289 
xtcq (specify count qualifier) command, 290-291 
xtelif (specify secondary branch qualifiers) command, 292-294 
xteq (external timing edge trigger) command, 338-339 
xtf (specify trace list format) command, 295-296 
xtg (specify trigger condition) command, 297-298 
xtgout (external trigger output) command, 108, 299-300 
xtgq (external timing glitch trigger) command, 340-341 
xth (trace halt) command, 301-302 

xtif (specify primary branch qualifiers) command, 303-305 

xtl (trace list) command, 308-309 

xdb (external trace label) command, 182, 310-311 

xtm (external timing analyzer mode) command, 342 

xtmo (external analyzer mode) command, 183, 343-344 

xtmo (external trace mode) command, 184 

xtp (trigger position in trace list) command, 312-313 

xtpat (complex config. trace patterns) command, 314-315 

xtpq (specify prestore qualifier) command, 316 

xtrng (specify complex config. range) command, 317-318 

xts (display trace status) command, 319-323 

xtsck (external trace slave clock) command, 189-190, 324-326 

xtsp (external timing sample period) command, 345 

xtsq (manipulate trace sequencer) command, 327-329 
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xtsto (specify trace storage qualifier) command, 330-331 
xtt (external timing trigger condition) command, 346-347 
xttd (external timing trigger delay) command, 348 
xttq (external timing transition trigger) command, 349-350 
xtv (threshold voltage for external trace signals), 181, 351 
xtx (trace on CMB /EXECUTE) command, 332 
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Certification and Warranty 



Certification 

Hewlett-Packard Company certifies that this product met its published 
specifications at the time of shipment from the factory. Hewlett-Packard further 
certifies that its calibration measurements are traceable to the United States 
National Bureau of Standards, to the extent allowed by the Bureau's calibration 
facility, and to the calibration facilities of other International Standards 
Organization members. 



Warranty 

This Hewlett-Packard system product is warranted against defects in materials and 
workmanship for a period of 90 days from date of installation. During the warranty 
period, HP will, at its option, either repair or replace products which prove to be 
defective. 

Warranty service of this product will be performed at Buyer's facility at no charge 
within HP service travel areas. Outside HP service travel areas, warranty service 
will be performed at Buyer's facility only upon HP's prior agreement and Buyer 
shall pay HP's round trip travel expenses. In all other cases, products must be 
returned to a service facility designated by HP. 

For products returned to HP for warranty service, Buyer shall prepay shipping 
charges to HP and HP shall pay shipping charges to return the product to Buyer. 
However, Buyer shall pay all shipping charges, duties, and taxes for products 
returned to HP from another country. HP warrants that its software and firmware 
designated by HP for use with an instrument will execute its programming 
instructions when properly installed on that instrument. HP does not warrant that 
the operation of the instrument, or software, or firmware will be uninterrupted or 
error free. 



Limitation of Warranty 



The foregoing warranty shall not apply to defects resulting from improper or 
inadequate maintenance by Buyer, Buyer-supplied software or interfacing, 
unauthorized modification or misuse, operation outside of the environment 
specifications for the product, or improper site preparation or maintenance. 

No other warranty is expressed or implied. HP specifically disclaims the 
implied warranties of merchantability and fitness for a particular purpose. 

Exclusive Remedies 

The remedies provided herein are buyer's sole and exclusive remedies. HP 
shall not be liable for any direct, indirect, special, incidental, or consequential 
damages, whether based on contract, tort, or any other legal theory. 

Product maintenance agreements and other customer assistance agreements are 
available for Hewlett-Packard products. 

For any assistance, contact your nearest Hewlett-Packard Sales and Service Office. 



Safety 



Summary of Safe Procedures 

The following general safety precautions must be observed during all phases of 
operation, service, and repair of this instrument. Failure to comply with these 
precautions or with specific warnings elsewhere in this manual violates safety 
standards of design, manufacture, and intended use of the instrument. 
Hewlett-Packard Company assumes no liability for the customer's failure to 
comply with these requirements. 



Ground The Instrument 

To minimize shock hazard, the instrument chassis and cabinet must be connected to 
an electrical ground. The instrument is equipped with a three-conductor ac power 
cable. The power cable must either be plugged into an approved three-contact 
electrical outlet or used with a three -contact to two-contact adapter with the 
grounding wire (green) firmly connected to an electrical ground (safety ground) at 
the power outlet. The power jack and mating plug of the power cable meet 
International Electrotechnical Commission (IEC) safety standards. 



Do Not Operate In An Explosive Atmosphere 

Do not operate the instrument in the presence of flammable gases or fumes. 
Operation of any electrical instrument in such an environment constitutes a definite 
safety hazard. 



Keep Away From Live Circuits 

Operating personnel must not remove instrument covers. Component replacement 
and internal adjustments must be made by qualified maintenance personnel. Do not 
replace components with the power cable connected. Under certain conditions, 
dangerous voltages may exist even with the power cable removed. To avoid 
injuries, always disconnect power and discharge circuits before touching them. 



Do Not Service Or Adjust Alone 



Do not attempt internal service or adjustment unless another person, capable of 
rendering first aid and resuscitation, is present. 

Do Not Substitute Parts Or Modify Instrument 

Because of the danger of introducing additional hazards, do not install substitute 
parts or perform any unauthorized modification of the instrument. Return the 
instrument to a Hewlett-Packard Sales and Service Office for service and repair to 
ensure that safety features are maintained. 

Dangerous Procedure Warnings 

Warnings, such as the example below, precede potentially dangerous procedures 
throughout this manual. Instructions contained in the warnings must be followed. 

Dangerous voltages, capable of causing death, are present in this instrument. Use 
extreme caution when handling, testing, and adjusting. 



Safety Symbols Used In Manuals 

The following is a list of general definitions of safety symbols used on equipment 
or in manuals: 

Instruction manual symbol: the product is marked with this symbol when it is 
necessary for the user to refer to the instruction manual in order to protect against 
damage to the instrument. 

Indicates dangerous voltage (terminals fed from the interior by voltage exceeding 
1000 volts must be marked with this symbol). 

Protective conductor terminal. For protection against electrical shock in case of a 
fault. Used with field wiring terminals to indicate the terminal which must be 
connected to ground before operating the equipment. 

Low-noise or noiseless, clean ground (earth) terminal. Used for a signal common, 
as well as providing protection against electrical shock in case of a fault. A terminal 
marked with this symbol must be connected to ground in the manner described in 
the installation (operating) manual before operating the equipment. 

"rame or chassis terminal. A connection to the frame (chassis) of the equipment 
'hich normally includes all exposed metal structures. 

Alternating current (power line). 

Direct current (power line). 



Alternating or direct current (power line). 



The Caution sign denotes a hazard. It calls your attention to an operating procedure, 
practice, condition, or similar situation, which, if not correctly performed or 
adhered to, could result in damage to or destruction of part or all of the product. 



The Warning sign denotes a hazard. It calls your attention to a procedure, practice, 
condition or the like, which, if not correctly performed, could result in injury or 
death to personnel. 



